PT-2021-3747 · Terracotta+1 · Ehcache+3

Harrison Neal · Published 2021-07-22 · Updated 2024-10-17 · CVE-2020-36239

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jira Data Center versions 6.3.0 through 8.5.16 Jira Data Center versions 8.6.0 through 8.13.8 Jira Data Center versions 8.14.0 through 8.17.0 Jira Core Data Center versions 6.3.0 through 8.5.16 Jira Core Data Center versions 8.6.0 through 8.13.8 Jira Core Data Center versions 8.14.0 through 8.17.0 Jira Software Data Center versions 6.3.0 through 8.5.16 Jira Software Data Center versions 8.6.0 through 8.13.8 Jira Software Data Center versions 8.14.0 through 8.17.0 Jira Service Management Data Center versions 2.0.2 through 4.5.16 Jira Service Management Data Center versions 4.6.0 through 4.13.8 Jira Service Management Data Center versions 4.14.0 through 4.17.0

Description The issue is related to a missing authentication vulnerability in the Ehcache RMI network service, which can allow remote attackers to execute arbitrary code in Jira through deserialization. The vulnerability can be exploited by connecting to the service on port 40001 and potentially 40011. Atlassian suggests restricting access to the Ehcache ports to only Data Center instances. Fixed versions of Jira will require a shared secret to allow access to the Ehcache service. In some versions, the Ehcache object port can be randomly allocated.

Recommendations For Jira Data Center versions 6.3.0 through 8.5.16, update to version 8.5.16 or later. For Jira Data Center versions 8.6.0 through 8.13.8, update to version 8.13.8 or later. For Jira Data Center versions 8.14.0 through 8.17.0, update to version 8.17.0 or later. For Jira Core Data Center versions 6.3.0 through 8.5.16, update to version 8.5.16 or later. For Jira Core Data Center versions 8.6.0 through 8.13.8, update to version 8.13.8 or later. For Jira Core Data Center versions 8.14.0 through 8.17.0, update to version 8.17.0 or later. For Jira Software Data Center versions 6.3.0 through 8.5.16, update to version 8.5.16 or later. For Jira Software Data Center versions 8.6.0 through 8.13.8, update to version 8.13.8 or later. For Jira Software Data Center versions 8.14.0 through 8.17.0, update to version 8.17.0 or later. For Jira Service Management Data Center versions 2.0.2 through 4.5.16, update to version 4.5.16 or later. For Jira Service Management Data Center versions 4.6.0 through 4.13.8, update to version 4.13.8 or later. For Jira Service Management Data Center versions 4.14.0 through 4.17.0, update to version 4.17.0 or later. As a temporary workaround, consider restricting access to the Ehcache ports to only Data Center instances.

Fix

Missing Authentication

Missing Authorization

Weakness Enumeration

CWE-306

CWE-862

Related Identifiers

BDU:2021-04000

CVE-2020-36239

Affected Products

Ehcache

Jira

Jira Core

Jira Service Management Server

References · 17

• https://bdu.fstec.ru/vul/2021-04000 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36239 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36239 · Vendor Advisory
• https://confluence.atlassian.com/adminjiraserver/jira-data-center-and-jira-service-management-data-center-security-advisory-2021-07-21-1063571388.html · Vendor Advisory
• https://jira.atlassian.com/browse/JSDSERVER-8454 · Vendor Advisory
• https://jira.atlassian.com/browse/JRASERVER-72566 · Vendor Advisory
• https://t.me/defcon_news/82262 · Telegram Post
• https://t.me/defcon_news/81749 · Telegram Post
• https://t.me/cvenotify/98541 · Telegram Post
• https://t.me/secharvester/11315 · Telegram Post
• https://t.me/cvenotify/18276 · Telegram Post
• https://t.me/cybersecuritytechnologies/3988 · Telegram Post
• https://t.me/cvenotify/34099 · Telegram Post
• https://habr.com/ru/news/t/569534 · Note
• https://t.me/cibsecurity/26565 · Telegram Post