Atlassian Application Links up to 5.2.6/5.3.3/5.4.2 OAuth Status Rest server-side request forgery

Summaryinfo

A vulnerability described as critical has been identified in Atlassian Application Links up to 5.2.6/5.3.3/5.4.2. The affected element is an unknown function of the component OAuth Status Rest. Executing a manipulation can lead to server-side request forgery. This vulnerability is tracked as CVE-2017-18096. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Atlassian Application Links up to 5.2.6/5.3.3/5.4.2. It has been declared as critical. This vulnerability affects an unknown code block of the component OAuth Status Rest. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the content of internal network resources via a Server Side Request Forgery (SSRF) by creating an OAuth application link to a location they control and then redirecting access from the linked location's OAuth status rest resource to an internal location. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access credentials and other potentially confidential information.

The bug was discovered 03/28/2018. The weakness was disclosed 04/04/2018 (Website). The advisory is shared for download at ecosystem.atlassian.net. This vulnerability was named CVE-2017-18096 since 02/01/2018. The exploitation appears to be easy. The attack can be initiated remotely. The requirement for exploitation is a single authentication. There are neither technical details nor an exploit publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 7 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 5.2.7, 5.3.4 or 5.4.3 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Atlassian

Name

• Application Links

Version

• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.2.4
• 5.2.5
• 5.2.6
• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.4.0
• 5.4.1
• 5.4.2

License

• free

Website

• Vendor: https://www.atlassian.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion