Categories: Cyber Security News

Misconfigured JIRA Servers Leaks NASA and Hundreds of Fortune 500 Companies Sensitive Data

A misconfiguration vulnerability with JIRA servers leaks internal user and project data of hundreds and thousands of companies which were using JIRA.

The JIRA is an Atlassian task tracking systems used by lots of companies for bug tracking and project management. It is used in over 135,000 companies in 122 countries. It is an intended tool used by IT and business service desks.

Security Engineer Avinash Jain discovered the misconfiguration vulnerability in JIRA servers that lets anyone access the “internal user data, their name, email ids, their project details on which they were working, assignee of those projects and various other information.”

Several companies affected with the vulnerability that includes tech giants such as “as NASA, Google, Yahoo to Go-Jek, HipChat, Zendesk, Sapient, Dubsmash, Western union, Lenovo, 1password, Informatica, etc and many sectors of various government around the world.”

Wrong Permissions in JIRA

The misconfiguration issue is because of the wrong permission assigned while creating the filters and dashboards, while creating new filter or dashboards by default the visibility set to all users and everyone, instead of sharing everyone within the organization.

If the permission set to everyone, then anyone can access the sensitive data by just having the URL and also being indexed by search engines. The leak exposes following sensitive details.

  • all account’s employees’ names and emails,
  • employees’ roles through JIRA groups,
  • current projects, upcoming milestones through JIRA dashboards/filters

By using Google dorks search queries anyone can craft the search queries and pull out the sensitive information from JIRA servers.

“Thousands of companies filters, dashboards and staff data were publically exposed. It occurs because of the wrong permissions scheme set to filters and dashboards hence providing their access even to non-logged in users and hence leading to leaking of sensitive data,” Avinash Jain said.

He reported the leak to the affected companies, some companies fixed the issue and some companies yet to fix the issue.

To change the setting you can edit the current filter and set the visibility based on the project needs.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting victims…

9 hours ago

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ advanced…

9 hours ago

XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests

A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to execute…

12 hours ago

Meta Removed 2 Million Account Linked to Malicious Activities

 Meta has announced the removal of over 2 million accounts connected to malicious activities, including…

16 hours ago

Veritas Enterprise Vault Vulnerabilities Lets Attackers Execute Arbitrary Code Remotely

Critical security vulnerability has been identified in Veritas Enterprise Vault, a widely-used archiving and content…

17 hours ago

7-Zip RCE Vulnerability Let Attackers Execute Remote Code

A critical security vulnerability has been disclosed in the popular file archiving tool 7-Zip, allowing…

17 hours ago