A critical flaw in the Atlassian platform, in multiple versions of its Jira Data Center and Jira Service Management Data Center products, should be patched immediately. The software engineering platform is used by 180,000 customers which are now endangered by remote, unauthenticated attacks, unless they patch the bug as soon as possible.
The bug is tracked as CVE-2020-36239. A list of affected versions is available in Atlassian’s advisory.
CVE-2020-36239: Critical Remote, Unauthenticated Flaw
CVE-2020-36239 is rated as a critical severity security vulnerability introduced in version 6.3.0 of Jira Data Center, Jira Core Data Center, Jira Software Data Center, and Jira Service Management Data Center, known as Jira Service Desk prior to 4.14.
According to Atlassian’s description of the issue, attackers can execute arbitrary code via deserialization due to a missing authentication flaw:
Jira Data Center, Jira Core Data Center, Jira Software Data Center, and Jira Service Management Data Center exposed a Ehcache RMI network service which attackers, who can connect to the service, on port 40001 and potentially 40011[0][1][2], could execute arbitrary code of their choice in Jira through deserialization due to a missing authentication vulnerability. While Atlassian strongly suggests restricting access to the Ehcache ports to only Data Center instances, fixed versions of Jira will now require a shared secret in order to allow access to the Ehcache service.
To address the issue, affected parties should apply the available patches immediately.
If the patches can’t be applied for some reason, a mitigation trick can be utilized. To mitigate CVE-2020-36239, you should restrict access to the Ehcache RMI ports to Jira Data Center, Jira Core Data Center, and Jira Software Data Center, and Jira Service Management Data Center to only cluster instances with the help of a firewall or a similar technology.
Milena Dimitrova
An inspired writer and content manager who has been with SensorsTechForum since the project started. A professional with 10+ years of experience in creating engaging content. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles! Follow Milena @Milenyim
Follow Me: