HipChat Server Security Advisory 2016-05-09

Date of Advisory:   10 AM PST(Pacific Standard Time, -8 hours)

CVE IDs: 

  • CVE-2016-3714 - ImageMagick - Insufficient shell characters filtering leads to (potentially remote) code execution
  • CVE-2016-3715 - ImageMagick - File deletion
  • CVE-2016-3716 - ImageMagick - File moving
  • CVE-2016-3717 - ImageMagick - Local file read
  • CVE-2016-3718 - ImageMagick - SSRF (Server-Side Request Forgery)

Product: HipChat Server

Affected Hipchat Server versions: 

  • version < 2.0 build 1.4.1

Fixed HipChat Server versions:

  • Version 2.0 build 1.4.1 of HipChat Server has been released with a fix for this issue. 

Summary of Vulnerability

This advisory discloses a critical severity security vulnerability in HipChat Server. All versions of HipChat Server before version 2.0 build 1.4.1 are vulnerable.

                                                       

Hipchat Cloud instances have already been upgraded to a version of HipChat which does not have the issue described on this page. 

Customers who have upgraded HipChat Server to version 2.0 build 1.4.1 or later are not affected.

Customers who have downloaded and installed HipChat Server less than version 2.0 build 1.4.1

Please upgrade your HipChat Server installations immediately to fix this vulnerability.

ImageMagick Image Parsing Vulnerabilities including CVE-2016-3714 (Remote Code Execution), CVE-2016-3715, CVE-2016-3716, CVE-2016-3717 and CVE-2016-3718

Severity

Atlassian rates the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels. The scale allows us to rank a severity as critical, high, moderate, or low.

This is an independent assessment and you should evaluate its applicability to your own IT environment.

Description

HipChat Server used a vulnerable version of the ImageMagick library without restricting coders. Attackers who can log in can use the ImageMagick vulnerabilities in vulnerable versions of HipChat Server to:

  • Execute remote code of their choice
  • Delete files that the www-data user has permission to delete
  • Move files that the www-data user has permission to move
  • Read files that the www-data user has permission to read
  • Make http requests to local and internal services

To exploit this issue, attackers need to have a valid account in a vulnerable HipChat Server instance.

All versions of HipChat Server before version 2.0 build 1.4.1 are affected by this vulnerability. This issue can be tracked here:  HCPUB-734 - ImageMagick Image Parsing Vulnerabilities including CVE-2016-3714 (Remote Code Execution), CVE-2016-3715, CVE-2016-3716, CVE-2016-3717 and CVE-2016-3718 Closed

                                                               

Fix

We have taken the following steps to address these issues:

Released HipChat Server version 2.0 build 1.4.1 that contains fixes for these issues. As of version 2.0 build 1.4.1:

  • HipChat Server checks if a file is a supported image format before passing the file to the ImageMagick library.
  • HipChat Server uses a policy file to disable vulnerable ImageMagick coders.

What You Need to Do

Upgrade (recommended)

The vulnerabilities and fix versions are described in the Description section above. Atlassian recommends that you upgrade to the latest version.  

                                                              

Upgrade HipChat Server to version 2.0 build 1.4.1 or higher.

Information on upgrading HipChat Server can be found at Upgrading HipChat Server. 

How do I check which version of HipChat Sever I am running?

You can check which version of HipChat Server you are running by going to https://your-server/server_admin/upgrade or by using ssh to log in to your HipChat Server and run cat /etc/hipchat-release.

For a full description of the latest version of HipChat Server, see the release notes.

                                                          

Support

If you have questions or concerns regarding this advisory, please raise a support request at https://support.atlassian.com/customer/servicedesk-portal.

References

Severity Levels for security issues Atlassian security advisories include a severity level and a CVE identifier. This severity level is based on our self-calculated CVSS score for each specific vulnerability. CVSS is an industry standard vulnerability metric. You can also learn more about CVSS at https://www.first.org/cvss/user-guide.
End-of-Life Policy Our end of life policy varies for different products. Please refer to our EoL Policy for details. 

Was this helpful?

Thanks for your feedback!

Why was this unhelpful?

Have a question about this article?

See questions about this article

Powered by Confluence and Scroll Viewport