Summary | CVE-2021-26068 - Remote Code Execution in Jira Server for Slack |
|---|
Advisory Release Date | 17 Feb 2021, 10 AM PDT |
|---|
Product | Jira Server for Slack plugin |
|---|
Affected Versions | All versions < 2.0.15
|
|---|
Fixed Versions |
2.0.15
|
|---|
CVE ID(s) |
CVE-2021-26068
|
|---|
Summary of Vulnerability
This advisory discloses a critical severity security vulnerability in Jira Server for Slack plugin. All versions of this plugin up to and including 2.0.14 are affected by this vulnerability. Jira Server and Data Center instances that don’t have this plugin installed are NOT affected by this vulnerability. By default, this plugin does not come installed in the Jira server and data center instances. However, if you do have this plugin installed in your server or data center instances, upgrade your app/plugin installations to version 2.0.15 immediately to fix this vulnerability. Also, note that this does NOT affect any Jira cloud instances.
Description
There is a remote code execution vulnerability affecting the Jira Server for Slack plugin that can be potentially exploited by any authenticated Jira user by sending malicious payloads to the affected endpoint. In a successful exploitation of this vulnerability, an attacker could potentially execute arbitrary code on the system.
This issue can be tracked here (currently restricted to Atlassian staff): https://confluence.atlassian.com/pages/viewpage.action?spaceKey=JIRA&title=Jira+Server+for+Slack+Security+Advisory+17th+February+2021&permissionViolation=true
What You Need to Do
Check whether your Jira server/DC instance has the vulnerable plugin installed or not. To do this, go to your applications and search for “Jira Server for Slack” plugin. If it is installed, check the version. If the version is less than 2.0.15, then the instance is vulnerable.
Upgrading the Plugin
Upgrade the plugin to the latest version. Details on how to update apps can be found here.
Mitigation
If you are unable to upgrade the plugin immediately, then as a temporary workaround, you can:
For a full description of the latest version of Jira Server for Slack, see the release notes - https://marketplace.atlassian.com/apps/1220099/jira-server-for-slack-official/version-history. You can download the latest version of the plugin from the Atlassian Marketplace.
