Vulnerabilities and Threats (Corvus Alerts)
      Back to home
      1. Knowledge Nest
      2. Cybersecurity Tips + Vulnerability Alerts
      3. Vulnerabilities and Threats (Corvus Alerts)

      Jira Vulnerability Alert | February 2023

      There's a critical vulnerability in Jira Service Management Server and Data Center. Here's what you need to know.

      Background

      On February 1, 2023, Atlassian issued a security advisory for a critical vulnerability. The flaw, CVE-2023-22501, affects Jira Service Management Server and Data Center commonly used for collaboration and development. The vulnerability allows an attacker to impersonate another user and gain access to a Jira Service Management instance. Atlassian has released a security update and this should be installed as soon as possible.

      Impact

      An attacker could gain access to signup tokens sent to users with accounts that have never been logged into. This is possible in certain configurations when write access to a User Directory and outgoing email are enabled on a Jira Service Management instance. Access to these tokens can be obtained in two cases:

      • If the attacker is included on Jira issues or requests with these users, or
      • If the attacker is forwarded or otherwise gains access to emails containing a “View Request” link from these users.

      Bot accounts are particularly susceptible to this vulnerability and could be targeted since their behavior often meets the criteria an attacker would need to acquire signup tokens. Corvus has observed similar vulnerabilities lead to data theft and extortion as well as ransomware attacks.

      The vulnerability affects the following versions of Jira Service Management Server and Jira Service Management Data Center:

      • 5.3.0
      • 5.3.1
      • 5.3.2
      • 5.4.0
      • 5.4.1
      • 5.5.0

      Note: Atlassian Cloud sites are not affected. If your Jira site is accessed via an atlassian.net domain, it is hosted by Atlassian and you are not affected by the vulnerability.

      Next Steps

      1. Update to a fixed version. 
      2. If you are unable to immediately upgrade Jira Service Management, you can manually upgrade the version-specific servicedesk-variable-substitution-plugin JAR file as a temporary workaround:
        1. Download the version-specific JAR file from the table at this page (see “Mitigation” section).
        2. Stop Jira.
        3. Copy the JAR file into your Jira home directory.
          1. For Server: <Jira_Home>/plugins/installed-plugins
          2. For Data Center: <Jira_Shared>/plugins/installed-plugins
        4. Start Jira.

      Resources