PT-2018-6675 · Atlassian+1 · Application Links+1

Published 2018-04-04 · Updated 2018-05-10 · CVE-2017-18096

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Atlassian Application Links versions prior to 5.2.7 Atlassian Application Links versions 5.3.0 through 5.3.3 Atlassian Application Links versions 5.4.0 through 5.4.2

Description: The issue allows remote attackers with administrative rights to access internal network resources via a Server Side Request Forgery (SSRF) by creating an OAuth application link to a location they control and then redirecting access from the linked location's OAuth status rest resource to an internal location. This flaw can be used to access a metadata resource that provides access credentials and other potentially confidential information, especially in environments like Amazon EC2.

Recommendations: For versions prior to 5.2.7, update to version 5.2.7 or later. For versions 5.3.0 through 5.3.3, update to version 5.3.4 or later. For versions 5.4.0 through 5.4.2, update to version 5.4.3 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2017-18096

Affected Products

Amazon Ec2

Application Links

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-18096 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18096 · Vendor Advisory
• https://ecosystem.atlassian.net/browse/APL-1359 · Vendor Advisory