ExploitCVE-2021-39115
Improper Control of Generation of Code ('Code Injection') (CWE-94)
Summary
Affected versions of Atlassian Jira Service Management Server and Data Center contain a Server-Side Template Injection vulnerability in the Email Template feature. This vulnerability allows remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands.
Impact
The impact of this vulnerability is severe. Attackers with Jira Administrator privileges can execute arbitrary Java code or system commands, potentially leading to complete system compromise. This could result in unauthorized access to sensitive data, modification of system configurations, disruption of services, and potential lateral movement within the network. The vulnerability has a high impact on confidentiality, integrity, and availability of the affected systems.
Exploitation
One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability has been fixed in Jira Service Management Server and Data Center version 4.13.9 and version 4.18.0. Users should upgrade to these or later versions to mitigate the risk.
Mitigation
1. Upgrade Atlassian Jira Service Management Server and Data Center to version 4.13.9 or 4.18.0 or later, depending on your current version. 2. If immediate patching is not possible, restrict and closely monitor access to Jira Administrator accounts. 3. Implement strong authentication mechanisms and regularly audit user access, especially for administrative accounts. 4. Monitor system logs for any suspicious activities related to the Email Template feature. 5. Apply the principle of least privilege to limit the potential impact if an account is compromised.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Timeline
Feedly found the first article mentioning CVE-2021-39115. See article
EPSS Score was set to: 0.24% (Percentile: 61.4%)