Summary

CVE-2017-7415 - XXE Out Of Band Extraction Vulnerability

Advisory Release Date

 

Product

SAML Single Sign On (SSO) for JIRA

SAML Single Sign On (SSO) for Confluence

Affected SAML SSO versions

0.14 - 0.14.6 (including)

Fixed SAML SSO versions

Versions of SAML SSO equal to and above 0.14.7 contain a fix for this issue.

The SAML Single Sign On (SSO) for Bitbucket Plugin is not affected.

CVE ID(s)TBA


Summary of Vulnerability

This advisory discloses a medium severity security vulnerability affecting SAML Single Sign On Plugin Version 0.14 - 0.14.6  for JIRA and Confluence. 

Please upgrade your Installations immediately to fix this vulnerability.

Versions before 0.14 are not affected.


Authenticated users can extract file system content from JIRA/Confluence Server via XXE Out of Band.


Severity

resolution rates the severity level of this vulnerability as medium, according to the CVS Specification 

Full CVS Scoring:

  • Serevity: Medium
  • Temporal Score: 6.0
  • CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C

This is an independent assessment and you should evaluate its applicability to your own IT environment.


Description

A REST API endpoint in the Confluence and JIRA plugins uses an unsafe DocumentBuilder parser to parse XML responses allowing for XXE attacks. 
The end result is that any authenticated user can read arbitrary files from the JIRA or Confluences servers filesystem including configuration, passwords, etc.

Acknowledgements

This Vulnerability has been disclosed to us via a third-party organisation as a responsible disclosure on 22.05.2017 23:55 CET. Further Credits TBD


Fix

We have taken the following steps to address this issue:

  1. Released SAML Plugin Version 0.14.7 that contains a fix for this issue.


What You Need to Do

Upgrade to SAML Plugin Version 0.14.7 or higher.


Support

If you have questions or concerns regarding this advisory, please raise a support request via our Support Portal.