Aggregator

一个很攻击门槛很低的漏洞。可结合其它漏洞配合来进行攻击。

首先来简单说一下这个漏洞，该漏洞就是在Jira 8.4.0以前的版本，攻击者可以在不经过授权的情况下访问/rest/api/latest/groupuserpicker这个路径来枚举用户。漏洞危害评级中危。

2020年2月3日在exploit-db上公布了该漏洞利用脚本。地址：
Jira 8.3.4 - Information Disclosure (Username Enumeration) 。

其漏洞很简单，只需要访问 http://target/rest/api/latest/groupuserpicker?query=admin （target为目标jira系统地址）。如果返回的是json字符串就说明存在漏洞。如果返回"You are not authenticated. Authentication required to perform this operation." 则说明不存在这个漏洞。

那漏洞应该如何利用呢？
1、通过字典方式，探测用户是否存在。
2、如果存在漏洞，那么一旦匹配到结果，则会返回json格式的字符串，其中包含来用户民、邮箱、和显示的名字信息。在实际测试中发现，请求的参数不一定是用户的全拼，例如我们输入c，也是可以返回相关结果的。我们可以改变query参数的值，从a至z遍历。这样就可以获取系统中的用户名列表。

通过以上获取信息后，可以进行后续的利用。比如爆破用户密码，邮箱密码，发送钓鱼邮件等等。具体根据实际场景和相关经验进行扩展。

1. Jira 8.3.4 - Information Disclosure (Username Enumeration)

2. More Jira Enumeration (usernames) – CVE-2019-8449

3. User enumeration through the groupuserpicker api resource - CVE-2019-8449

About 18 years ago I worked on the final year project for my Bachelor’s degree in Computer Science. I had just gotten interested in security and was learning about security principles.

The title of the project was “Web Application Security Principles - Designing Secure Web Based Enterprise Solutions”.

Looking back, a really cool thing was that I had just started working at Microsoft as an Associate Development Consultant and was bold enough to send the paper last minute over to Michael Howard - who responded and indeed reviewed it! That was so cool! :)

Kia ora koutou

Thank you for the opportunity to update the Committee about the work of the GCSB since I last appeared before you.

This post highlights a simple mitigation to improve the security posture of your organization. The idea is to, by practical means, limit attack surface and prevent spreading of automated malware, as well as limiting lateral movement by adversaries.

Malware can spread fast and damage businesses at scale.

SQL Slammer [1] and WannaCry [2] are two well-known cases that showed how quickly and damaging this can be. Interstingly, both of these disasters were nearly 15 years apart.