Very High
Atlassian Crowd: pdkinstall development plugin incorrectly enabled (CVE-2019-11580)
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
Very High
(3 users assessed)
Very High
(3 users assessed)Unknown
Unknown
Unknown
Atlassian Crowd: pdkinstall development plugin incorrectly enabled (CVE-2019-11580)
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center.
Add Assessment
Ratings
-
Attacker ValueHigh
-
ExploitabilityVery High
Technical Analysis
Assessment
I think I would see this in the real world, exploitation is trivial, and attacking an SSO system could be valuable.
Additional analysis
What would happen if I changed the
Content-Typefrommultipart/form-datato a differentmultipartencoding? Let’s try it.This time I decided to try uploading my malicious plugin with the Content-Type of
multipart/mixedinstead. Maybe that would work?
They didn’t share how they got there, but it’s an easy find with source code.
wvu@kharak:~$ cd Downloads/ wvu@kharak:~/Downloads$ git clone https://bitbucket.org/atlassian/pdkinstall-plugin.git Cloning into 'pdkinstall-plugin'... remote: Counting objects: 210, done. remote: Compressing objects: 100% (115/115), done. remote: Total 210 (delta 88), reused 138 (delta 56) Receiving objects: 100% (210/210), 26.20 KiB | 813.00 KiB/s, done. Resolving deltas: 100% (88/88), done. wvu@kharak:~/Downloads$ cd pdkinstall-plugin/ wvu@kharak:~/Downloads/pdkinstall-plugin:master$ git grep isMultipart src/main/java/com/atlassian/pdkinstall/PdkInstallFilter.java: boolean isMultipart = ServletFileUpload.isMultipartContent(req); src/main/java/com/atlassian/pdkinstall/PdkInstallFilter.java: if (isMultipart) wvu@kharak:~/Downloads/pdkinstall-plugin:master$ git grep ServletFileUpload src/main/java/com/atlassian/pdkinstall/PdkInstallFilter.java:import org.apache.commons.fileupload.servlet.ServletFileUpload; src/main/java/com/atlassian/pdkinstall/PdkInstallFilter.java: boolean isMultipart = ServletFileUpload.isMultipartContent(req); src/main/java/com/atlassian/pdkinstall/PdkInstallFilter.java: ServletFileUpload upload = new ServletFileUpload(factory); wvu@kharak:~/Downloads/pdkinstall-plugin:master$
This class handles multiple files per single HTML widget, sent using
multipart/mixedencoding type, as specified by RFC 1867.
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild Report
Ratings
-
Attacker ValueVery High
-
ExploitabilityVery High
Technical Analysis
Looks like a good source of additional data for further exploitation.
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild Report
Technical Analysis
This is now supposedly being exploited in the wild by Chinese state actors according to this NSA announcement: https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportGeneral Information
Exploited in the Wild
- Government or Industry Alert (https://us-cert.cisa.gov/ncas/alerts/aa21-209a)
- Other: 2020 Most Exploited Vulnerabilities (https://www.ic3.gov/Media/News/2021/210728.pdf)
Would you like to delete this Exploited in the Wild Report?
Yes, delete this reportReferences
Additional Info
Technical Analysis
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
