2017-05-23-01 XXE Out Of Band Extraction Vulnerability

Summary	CVE-2017-7415 - XXE Out Of Band Extraction Vulnerability
Advisory Release Date	5/23/2017
Product	SAML Single Sign On (SSO) for JIRA SAML Single Sign On (SSO) for Confluence
Affected SAML SSO versions	0.14 - 0.14.6 (including)
Fixed SAML SSO versions	Versions of SAML SSO equal to and above 0.14.7 contain a fix for this issue. The SAML Single Sign On (SSO) for Bitbucket Plugin is not affected.
CVE ID(s)	TBA

Summary of Vulnerability

This advisory discloses a medium severity security vulnerability affecting SAML Single Sign On Plugin Version 0.14 - 0.14.6 for JIRA and Confluence.

Please upgrade your Installations immediately to fix this vulnerability.

Versions before 0.14 are not affected.

Authenticated users can extract file system content from JIRA/Confluence Server via XXE Out of Band.

Severity

resolution rates the severity level of this vulnerability as medium, according to the CVS Specification

Full CVS Scoring:

Serevity: Medium
Temporal Score: 6.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C

This is an independent assessment and you should evaluate its applicability to your own IT environment.

Description

A REST API endpoint in the Confluence and JIRA plugins uses an unsafe DocumentBuilder parser to parse XML responses allowing for XXE attacks.
The end result is that any authenticated user can read arbitrary files from the JIRA or Confluences servers filesystem including configuration, passwords, etc.

Acknowledgements

This Vulnerability has been disclosed to us via a third-party organisation as a responsible disclosure on 22.05.2017 23:55 CET. Further Credits TBD

Fix

We have taken the following steps to address this issue:

Released SAML Plugin Version 0.14.7 that contains a fix for this issue.

What You Need to Do

Upgrade to SAML Plugin Version 0.14.7 or higher.

Support

If you have questions or concerns regarding this advisory, please raise a support request via our Support Portal.