Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Server-Side Request Forgery Exposes Data of Technology, Industrial and Media Organizations

Summary: Unit 42 researchers scanned six public cloud providers and found 7,002 Jira instances, of which 3,152 (45%) were unpatched and confirmed vulnerable to the SSRF flaw CVE-2019-8451, and 1,779 (56%) of those leaked host metadata. The flaw, which lets an at (@) symbol in the makeRequest URL bypass the JiraWhiteList allowlist, was listed as affecting versions from v7.6 but the researchers found it present back to v4.3 from March 2011, and metadata leak rates ran from 93% at DigitalOcean to zero at Azure, whose metadata API requires a 'Metadata: True' header.

What you should know: A single unauthenticated SSRF in an internet-facing app can reach the 169.254.169.254 metadata endpoint and pull the credentials attached to the instance - the same path that led to the Capital One breach in July 2019 - and 45% of the Jira instances found in public cloud were still unpatched.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Data Breaches
Mentions
CVE-2019-8451
Related