Atlassian addresses a critical Jira authentication bypass flaw

Atlassian fixed a critical flaw in its Jira software, tracked as CVE-2022-0540, that could be exploited to bypass authentication.

Atlassian has addressed a critical vulnerability in its Jira Seraph software, tracked as CVE-2022-0540 (CVSS score 9.9), that can be exploited by an unauthenticated attacker to bypass authentication. A threat actor could trigger the vulnerability by sending a specially crafted HTTP request to vulnerable software.

The issue affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. The flaw also impacts Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.

“Jira and Jira Service Management are vulnerable to an authentication bypass in its web authentication framework, Jira Seraph. Although the vulnerability is in the core of Jira, it affects first and third party apps that specify roles-required at the webwork1 action namespace level and do not specify it at an action level. For a specific action to be affected, the action will also need to not perform any other authentication or authorization checks.” reads the security advisory published by the company. “A remote, unauthenticated attacker could exploit this by sending a specially crafted HTTP request to bypass authentication and authorization requirements in WebWork actions using an affected configuration.”

The company also provided mitigations for those users that are unable to install a fixed version of Jira or Jira Service Management and are using any affected apps. It recommends users to update any affected apps to a non-affected version.

Customers that are using any apps listed in the Determining which apps are affected section and all versions of the app are affected can mitigate the security risk by disabling the app until they’re able to install a fixed version of Jira or Jira Service Management.

The vulnerability was reported by Khoadha of Viettel Cyber Security.

In September, Trend Micro researchers spotted crypto-mining campaigns that were actively exploiting another critical remote code execution vulnerability, tracked as CVE-2021-26084, in Atlassian Confluence deployments across Windows and Linux.

Please vote for Security Affairs as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog” and others of your choice.
To nominate, please visit: https://docs.google.com/forms/d/e/1FAIpQLSfxxrxICiMZ9QM9iiPuMQIC-IoM-NpQMOsFZnJXrBQRYJGCOw/viewform  

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Atlassian)