Server-sided vulnerability found in Jira

A serious server-side vulnerability in Jira is revealed by the security firm Palo Alto Networks.

Security firm Palo Alto Networks found a server-side request forgery (SSRF) vulnerability, that involves a web application redirecting a request to the internal network or localhost behind the firewall. According to the reports, the security researchers found more than 7,000 Jira instances exposed to public clouds. 45% of which is vulnerable to the particular vulnerability. And 56 of the vulnerable hosts leaking cloud infrastructure metadata, which can cause serious problems.

No leaks from Microsoft Azure

Digital Ocean has the highest data leaks rate with 93%. Google Cloud comes second with 80% and Alibaba is third with its 71% rate. Leakage percentage for Amazon Web Services is 68% and for Hetzner it is 21%. There are no leaks from Microsoft Azure because it blocks metadata API SSRF requests by default.

Researchers said:

“SSRF by itself may not be a severe vulnerability, but when coupled with the metadata API and misconfiguration in cloud infrastructure, SSRF opens the door to many other attack vectors. Sensitive metadata such as credentials and network architecture may be leaked, and internal services such as database and storage could be exposed. In the worst case, the entire cloud infrastructure could be compromised.”

Source

Stay tuned for up-to-date Cyber Security News