Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-71175

Information disclosure in Login - CVE-2020-4028

XMLWordPrintable

      Users without session information should be pushed to the login page.
      Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in Login.

      Affected versions:

      • version < 8.9.1

      Fixed versions:

      • 8.9.1
      • 8.10.0
      • 8.11.0

      Notes:

      If the fix is causing problems it can be disabled by adding to Jira a dark feature flag

      jira.redirect.anonymous.404.errors.disabled

      The fix is available in LTS versions - 7.13.15+ and 8.5.6+ but will be disabled. The fix can be enabled by adding to Jira a dark feature flag

      jira.redirect.anonymous.404.errors.enabled

      Both feature flags can be added by admin via site `<jira_directory>/secure/SiteDarkFeatures!default.jspa`

            [JRASERVER-71175] Information disclosure in Login - CVE-2020-4028

            Lee Meinecke added a comment -

            ^^ That's a good question. We do not have that enabled in our instance. 

            Lee Meinecke added a comment - ^^ That's a good question. We do not have that enabled in our instance. 

            Nancy Orlowski added a comment -

            Does 'Anonymous Access' need to be enabled to have this vulnerability?

            Nancy Orlowski added a comment - Does 'Anonymous Access' need to be enabled to have this vulnerability?

            jira guy added a comment -

            this is not fixed in 8.11.1 version

            jira guy added a comment - this is not fixed in 8.11.1 version

            Anoop Wilson added a comment -

            Why this is not  added in Enterprise Releases,I am seeing a similar behavior in Bitbucket as well.

            Anoop Wilson added a comment - Why this is not  added in Enterprise Releases,I am seeing a similar behavior in Bitbucket as well.

            Lee Meinecke added a comment - - edited

            We've updated to 8.5.6 and applied the setting below however it still shows up on our Qualys scans. I don't know for sure if it is just a FP because it is only checking version and not what the dark setting is actually doing. How can I confirm the dark setting and software update is actually working? 

            jira.redirect.anonymous.404.errors.enabled

            Lee Meinecke added a comment - - edited We've updated to 8.5.6 and applied the setting below however it still shows up on our Qualys scans. I don't know for sure if it is just a FP because it is only checking version and not what the dark setting is actually doing. How can I confirm the dark setting and software update is actually working?  jira.redirect.anonymous.404.errors.enabled

            James added a comment - - edited

            Since it's the 404 page that's leaky, you can use a custom 404 page until you can upgrade as a workaround, yeah?

            It sounds like it's the issue of the 404 in itself that's the disclosure. So any would have the same effect:

            Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this may have allowed unauthorised attackers to determine if certain resources exist or not through an Information Disclosure vulnerability.

            Workaround could be to intercept all 404s generated by Jira (from non-logged-in users if possible) and redirect them to the login page.

            James added a comment - - edited Since it's the 404 page that's leaky, you can use a custom 404 page until you can upgrade as a workaround, yeah? It sounds like it's the issue of the 404 in itself that's the disclosure. So any would have the same effect: Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this may have allowed unauthorised attackers to determine if certain resources exist or not through an Information Disclosure vulnerability. Workaround could be to intercept all 404s generated by Jira (from non-logged-in users if possible) and redirect them to the login page.

            David Yu added a comment -

            Since it's the 404 page that's leaky, you can use a custom 404 page until you can upgrade as a workaround, yeah?

            This is pretty simple with a proxy such as nginx--use proxy_intercept_errors, and then direct to a plain 'ol 404.html page.

            David Yu added a comment - Since it's the 404 page that's leaky, you can use a custom 404 page until you can upgrade as a workaround, yeah? This is pretty simple with a proxy such as nginx--use proxy_intercept_errors, and then direct to a plain 'ol 404.html page.

            Pawel Przytarski added a comment -

            6913611e79d0 I checked with Mobile App team. They are aware of this issue and are working on it.  They should solve the problem in the near future. No specific dates yet.

            Pawel Przytarski added a comment - 6913611e79d0  I checked with Mobile App team. They are aware of this issue and are working on it.  They should solve the problem in the near future. No specific dates yet.

            Edward Alekxandr added a comment - - edited

            I can confirm that adding this dark feature flag allows the Jira mobile app to connect and login.

             

            When are the Mobile App team changing the app to not require this?

            Edward Alekxandr added a comment - - edited I can confirm that adding this dark feature flag allows the Jira mobile app to connect and login.   When are the Mobile App team changing the app to not require this?

            Tobias Heinemann added a comment - - edited

            I am excited to see if the bug fix will be backported at all. According to the bug fix policy this is done for critical bugs only.
            Thank you for the update Pawel.

            Tobias Heinemann added a comment - - edited I am excited to see if the bug fix will be backported at all. According to the bug fix policy this is done for critical bugs only. Thank you for the update Pawel.

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Affected customers:
              0 This affects my team
              Watchers:
              26 Start watching this issue

                Created:
                Updated:
                Resolved: