Friday, December 1, 2023

Misconfigured JIRA Servers Leaks NASA and Hundreds of Fortune 500 Companies Sensitive Data

A misconfiguration vulnerability with JIRA servers leaks internal user and project data of hundreds and thousands of companies which were using JIRA.

The JIRA is an Atlassian task tracking systems used by lots of companies for bug tracking and project management. It is used in over 135,000 companies in 122 countries. It is an intended tool used by IT and business service desks.

Security Engineer Avinash Jain discovered the misconfiguration vulnerability in JIRA servers that lets anyone access the “internal user data, their name, email ids, their project details on which they were working, assignee of those projects and various other information.”

Several companies affected with the vulnerability that includes tech giants such as “as NASA, Google, Yahoo to Go-Jek, HipChat, Zendesk, Sapient, Dubsmash, Western union, Lenovo, 1password, Informatica, etc and many sectors of various government around the world.”

Wrong Permissions in JIRA

The misconfiguration issue is because of the wrong permission assigned while creating the filters and dashboards, while creating new filter or dashboards by default the visibility set to all users and everyone, instead of sharing everyone within the organization.

If the permission set to everyone, then anyone can access the sensitive data by just having the URL and also being indexed by search engines. The leak exposes following sensitive details.

  • all account’s employees’ names and emails,
  • employees’ roles through JIRA groups,
  • current projects, upcoming milestones through JIRA dashboards/filters

By using Google dorks search queries anyone can craft the search queries and pull out the sensitive information from JIRA servers.

“Thousands of companies filters, dashboards and staff data were publically exposed. It occurs because of the wrong permissions scheme set to filters and dashboards hence providing their access even to non-logged in users and hence leading to leaking of sensitive data,” Avinash Jain said.

He reported the leak to the affected companies, some companies fixed the issue and some companies yet to fix the issue.

To change the setting you can edit the current filter and set the visibility based on the project needs.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.


Latest articles

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

CISA Warns Hackers Exploiting Wastewater Systems Logic Controllers

In a disconcerting turn of events, cyber threat actors have set their sights on...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles