CVE-2020-14179 PoC — Atlassian Jira 信息泄露漏洞

Source

https://github.com/mrnazu/CVE-2020-14179

Associated Vulnerability

Title:Atlassian Jira 信息泄露漏洞 (CVE-2020-14179)
Description:Atlassian Jira是澳大利亚Atlassian公司的一套缺陷跟踪管理系统。该系统主要用于对工作中各类问题、缺陷进行跟踪管理。 Atlassian Jira 存在安全漏洞。该漏洞源于Jira Server and Data Center允许远程、未经身份验证的攻击者通过/secure/QueryComponent!Default中的一个信息泄露漏洞查看定制字段名和定制SLA名。以下是受影响的产品及版本：8.5.8版本之前，8.6.0版本至8.11.1版本。

Description

Sensitive data exposure via /secure/QueryComponent!Default.jspa endpoint - CVE-2020-14179

Readme

# CVE-2020-14179

Sensitive data exposure via `/secure/QueryComponent!Default.jspa` endpoint

- Priority: High
- Affects Version/s: 8.6.0 | 8.8.0 | 8.5.5 | 8.9.0 | 8.10.0 | 8.11.0

Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the `/secure/QueryComponent!Default.jspa` endpoint. 

As my knowledge goes, 9.11.0, 9.7.1...  also affected 😂

## Overview of [CVE-2020-14179_Finder.sh](https://github.com/mrnazu/CVE-2020-14179/blob/main/CVE-2020-14179_Finder.sh)
CVE-2020-14179 Finder is a simple bash script designed to check if a target is vulnerable to the `CVE-2020-14179`. 

The script uses a specific HTTP request via `curl` to the `/secure/QueryComponent!Default.jspa` endpoint and analyzes the response to determine vulnerability.

## Features
- Sends a request to the specified endpoint `/secure/QueryComponent!Default.jspa`.
- Analyzes the response to determine vulnerability.
- Outputs color-coded results for easy identification.
- Stores request and response details in the "results" folder.

![image](https://github.com/mrnazu/CVE-2020-14179/assets/108541991/a7ef4116-a2cd-47ff-bc05-783e92bfa62c)

## Installation
1. Clone the repository:
- `git clone https://github.com/mrnazu/CVE-2020-14179.git`
2. Navigate to the script directory:
- `cd CVE-2020-14179`
3. Run the script:
- For a list of targets from a file: `./CVE-2020-14179_Finder.sh -l target.txt`
- For a single target URL: `./CVE-2020-14179_Finder.sh -u http://target.com/`

## Contributions
This script is provided for educational and research purposes only. Use it responsibly and only on systems you have permission to test.

File Snapshot


 [4.0K]  /data/pocs/de714c823cf2f6d923a358c2b0d80e00765012d9
├── [3.2K]  CVE-2020-14179_Finder.sh
└── [1.7K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!