Analysis of Jira Bug Stresses Impact of SSRF in Public Cloud

guest · Nov 28, 2019

Analysis of Jira Bug Stresses Impact of SSRF in Public Cloud
More than 3,100 Jira instances are still vulnerable to a server-side request forgery vulnerability patched in August
November 27, 2019
https://www.darkreading.com/cloud/a...mpact-of-ssrf-in-public-cloud-/d/d-id/1336479

Thousands of Jira instances remain vulnerable to server-side request forgery (SSRF), a Web application vulnerability that redirects malicious requests to resources restricted to a server. The extent of this exposure underscores the impact of SSRF on applications in the public cloud.

SSRF poses a threat to cloud services due to the use of metadata API, which allows applications to access configurations, logs, credentials, and other information in the underlying cloud infrastructure.
The root cause of SSRF is a Web application needs to get resources from another domain to fulfill the request, but the input URL isn't properly sanitized and could let attackers manipulate the destination

To understand the effects of SSRF in the public cloud, researchers with Palo Alto Networks' Unit 42 investigated known Jira SSRF flaw CVE-2019-8451 and analyzed its impact on six public cloud service providers (CSPs).
Click to expand...

"What was especially significant was what the attackers had access to and how long the vulnerability had been out there," says Jen Miller-Osborn, deputy director of threat intelligence at Unit 42. The fact an exploit would have worked as far back as 2011 "was concerning."
The researchers' vulnerability scanner found 7,002 Jira instances exposed to the Internet in these six selected public clouds. Forty-five percent of the 7,002 instances (3,152) are vulnerable to this CVE because they haven't been patched or updated. More than half (56%) of these vulnerable hosts (1,779) leak cloud infrastructure metadata, the Unit 42 team explains in a blog post.
Click to expand...

Palo Alto Networks - Unit42: Server-Side Request Forgery Exposes Data of Technology, Industrial and Media Organizations

Log in or Sign up

Analysis of Jira Bug Stresses Impact of SSRF in Public Cloud

guest Guest

Log in or Sign up

Analysis of Jira Bug Stresses Impact of SSRF in Public Cloud

guest Guest

Useful Searches