Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-70944

Make use of Secure Introspector in Velocity Templates - CVE-2019-20409

XMLWordPrintable

    • 8.03
    • Severity 2 - Major
    • Hide
      Atlassian Update – 05 October 2020

      Hi everyone,

      thank you for all your comments and questions.

      We would like to inform you that we have been investigating the possibility of backporting the requested functionality to Jira LTS versions 7.13x and 8.5.x. Unfortunately this improvement causes problems with non-Atlassian plugins preventing them from working correctly. Due to its technical complexity we cannot provide any means of disabling it without manipulation with Jira files.
      We treat this issue as a security improvement, not a security vulnerability that can be exploited. We have made it harder for an attacker to exploit potential server-side template injection vulnerabilities in the future Jira releases.

      In the light of the above, we have decided not to backport the requested functionality to both Jira 8.5.x and 7.13.x LTS releases.

      We understand that this decision may be disappointing, however we want to assure you that we will keep treating all server-side template injection vulnerabilities as high or critical severity issues if they affect our LTS releases.

      For those customers who are currently using our LTS versions, we have prepared a workaround (please see the description field of this issue). After applying the workaround all native Jira functionality should work as before, however some 3rd party and your own internal apps may stop working or cause problems with other Jira functionality. You can use this workaround at your own discretion.

      The security improvement will be available in our upcoming 8.13 LTS release. If you have any questions or feedback about the workaround, please leave us a comment.

      Kind regards,
      Paweł Przytarski
      Jira Server Bugfix Team

      Show
      Atlassian Update – 05 October 2020 Hi everyone, thank you for all your comments and questions. We would like to inform you that we have been investigating the possibility of backporting the requested functionality to Jira LTS versions 7.13x and 8.5.x. Unfortunately this improvement causes problems with non-Atlassian plugins preventing them from working correctly. Due to its technical complexity we cannot provide any means of disabling it without manipulation with Jira files. We treat this issue as a security improvement, not a security vulnerability that can be exploited. We have made it harder for an attacker to exploit potential server-side template injection vulnerabilities in the future Jira releases. In the light of the above, we have decided not to backport the requested functionality to both Jira 8.5.x and 7.13.x LTS releases. We understand that this decision may be disappointing, however we want to assure you that we will keep treating all server-side template injection vulnerabilities as high or critical severity issues if they affect our LTS releases. For those customers who are currently using our LTS versions, we have prepared a workaround (please see the description field of this issue). After applying the workaround all native Jira functionality should work as before, however some 3rd party and your own internal apps may stop working or cause problems with other Jira functionality. You can use this workaround at your own discretion. The security improvement will be available in our upcoming 8.13 LTS release. If you have any questions or feedback about the workaround, please leave us a comment. Kind regards, Paweł Przytarski Jira Server Bugfix Team

      This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented.

      The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability.

      Affected versions:

      • version < 8.8.0

      Fixed versions:

      • 8.8.0

      Workaround for previous versions:
      You use this workaround at your own discretion.

      1. Download Jira 8.12 as zip and extract it’s content
      2. Localize your Jira instance installation directory
      3. Shutdown your Jira instance
      4. Go to the <jira_installation_dir>/atlassian-jira/WEB-INF/lib/ directory
      5. Remove files: velocity-htmlsafe-3.0.0.jar and velocity-1.6.4-atlassian-7.jar
      6. Copy files velocity-htmlsafe-3.1.1.jar and velocity-1.6.4-atlassian-21.jar from downloaded Jira 8.12 to current directory. They are found in the <Jira_8_12_dir>/atlassian-jira/WEB-INF/lib/ directory
      7. Go to the <jira_installation_dir>/atlassian-jira/WEB-INF/classes directory
      8. Replace the velocity.properties and velocity-static.properties files with their counterparts from the downloaded Jira 8.12
      9. Start your Jira instance again

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Votes:
              0 Vote for this issue
              Watchers:
              42 Start watching this issue

                Created:
                Updated:
                Resolved: