CVE-2012-2926
published 2012-05-22CVE-2012-2926: Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7…
PriorityP274critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EXPLOIT
EPSS
66.58%
99.2th percentile
Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | bamboo | < 3.3.4 | 3.3.4 |
| atlassian | bamboo | >= 3.4 < 3.4.5 | 3.4.5 |
| atlassian | confluence | < 3.5.16 | 3.5.16 |
| atlassian | confluence_server | >= 4.0 < 4.0.7 | 4.0.7 |
| atlassian | confluence_server | >= 4.1 < 4.1.10 | 4.1.10 |
| atlassian | crowd | < 2.0.9 | 2.0.9 |
| atlassian | crowd | >= 2.1 < 2.1.2 | 2.1.2 |
| atlassian | crowd | >= 2.2.0 < 2.2.9 | 2.2.9 |
| atlassian | crowd | >= 2.3.0 < 2.3.7 | 2.3.7 |
| atlassian | crowd | >= 2.4.0 < 2.4.1 | 2.4.1 |
| atlassian | crucible | < 2.5.8 | 2.5.8 |
| atlassian | crucible | >= 2.6 < 2.6.8 | 2.6.8 |
| atlassian | crucible | >= 2.7 < 2.7.12 | 2.7.12 |
| atlassian | fisheye | < 2.5.8 | 2.5.8 |
| atlassian | fisheye | >= 2.6 < 2.6.8 | 2.6.8 |
| atlassian | fisheye | >= 2.7 < 2.7.12 | 2.7.12 |
| atlassian | jira | < 5.0.1 | 5.0.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect XML External Entity (XXE) / entity expansion (Billion Laughs) attacks targeting Atlassian products by inspecting POST request bodies for deeply nested XML entity declarations combined with a SYSTEM identifier, particularly against JIRA, Confluence, Crowd, Bamboo, FishEye, and Crucible endpoints. ↗
- →Flag inbound HTTP requests with Content-Type 'text/xml' and a blank or empty SOAPAction header targeting Atlassian product endpoints, as this matches the attack delivery mechanism observed in exploit PoC traffic. ↗
- →Alert on XML payloads containing recursive or chained entity references (e.g., '&lol9;' style references) in POST bodies to Atlassian application endpoints — characteristic of a Billion Laughs DoS payload. ↗
- →Detect exploitation of Atlassian Crowd's XML file handling by monitoring for XML payloads that attempt to expand external entities using the SYSTEM identifier, which can be used to read arbitrary remote files. ↗
- →Monitor for Metasploit auxiliary module 'scanner/http/atlassian_crowd_fileaccess' activity against Atlassian Crowd instances, which automates remote file read via XXE. ↗
- ·The vulnerability affects multiple Atlassian products across many version ranges (JIRA < 5.0.1, Confluence < 3.5.16/4.0.7/4.1.10, FishEye/Crucible < 2.5.8/2.6.8/2.7.12, Bamboo < 3.3.4/3.4.5, Crowd < 2.0.9/2.1.2/2.2.9/2.3.7/2.4.1); detection rules should not be scoped to a single product or version. ↗
- ·Third-party JIRA plugins (Gliffy, Tempo) are also independently vulnerable; detection and patching scope must include plugins, not just the core JIRA application. ↗
- ·The Metasploit module targets Atlassian Crowd specifically for file read (XXE with SYSTEM identifier), while the PoC exploit targets JIRA/Gliffy/Tempo for DoS (entity expansion); detection logic should cover both attack variants. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Atlassian Tempo 6.4.3 / JIRA 5.0.0 / Gliffy 3.7.0 - XML Parsing Denial of Service
exploitdb·2012-05-17
CVE-2012-2926 Atlassian Tempo 6.4.3 / JIRA 5.0.0 / Gliffy 3.7.0 - XML Parsing Denial of Service
Atlassian Tempo 6.4.3 / JIRA 5.0.0 / Gliffy 3.7.0 - XML Parsing Denial of Service
---
source: https://www.securityfocus.com/bid/53595/info
JIRA, and the Gliffy and Tempo plugins for JIRA are prone to a denial-of-service vulnerability because they fail to properly handle crafted XML data.
Exploiting this issue allows remote attackers to cause denial-of-service conditions in the context of an affected application.
The following versions are affected:
Versions prior to JIRA 5.0.1 are vulnerable.
Versions prior to Gliffy 3.7.1 are vulnerable.
Versions prior to Tempo versions 6.4.3.1, 6.5.1, and 7.0.3 are vulnerable.
POST somehost.com HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml;charset=UTF-8
SOAPAction: ""
User-Agent: Jakarta Commons-HttpClient/3.1
Host: somehost.com
Co
Metasploit
Atlassian Crowd XML Entity Expansion Remote File Access
metasploit
Atlassian Crowd XML Entity Expansion Remote File Access
Atlassian Crowd XML Entity Expansion Remote File Access
This module simply attempts to read a remote file from the server using a vulnerability in the way Atlassian Crowd handles XML files. The vulnerability occurs while trying to expand external entities with the SYSTEM identifier. This module has been tested successfully on Linux and Windows installations of Crowd.
No writeups or analysis indexed.
http://confluence.atlassian.com/display/BAMBOO/Bamboo+Security+Advisory+2012-05-17http://confluence.atlassian.com/display/CROWD/Crowd+Security+Advisory+2012-05-17http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2012-05-17http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17http://osvdb.org/81993http://secunia.com/advisories/49146http://www.securityfocus.com/bid/53595https://exchange.xforce.ibmcloud.com/vulnerabilities/75682https://exchange.xforce.ibmcloud.com/vulnerabilities/75697http://confluence.atlassian.com/display/BAMBOO/Bamboo+Security+Advisory+2012-05-17http://confluence.atlassian.com/display/CROWD/Crowd+Security+Advisory+2012-05-17http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-05-17http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2012-05-17http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17http://osvdb.org/81993http://secunia.com/advisories/49146http://www.securityfocus.com/bid/53595https://exchange.xforce.ibmcloud.com/vulnerabilities/75682https://exchange.xforce.ibmcloud.com/vulnerabilities/75697
2012-05-22
Published