JIRA and HipChat for JIRA plugin Security Advisory 2015-08-26

HipChat for JIRA plugin - Velocity Template Injection - HC-18903

Note: As of September 2014, we are no longer issuing binary bug patches. Instead we create new maintenance releases for the major versions we are backporting.

Date of Advisory: 26/August/2015 (UTC)

CVE ID: CVE-2015-5603

Product: JIRA and the HipChat for JIRA plugin.

Affected HipChat For JIRA plugin versions: 1.3.2 <= version < 6.30.0

Affected JIRA product versions: 6.3.5 <= version <  6.4.11

Summary of Vulnerability

This advisory discloses a critical severity security vulnerability that was introduced in version 1.3.2 of the HipChat for JIRA plugin. Versions of the HipChat for JIRA plugin starting with 1.3.2 before 6.30.0 (the fixed version) are vulnerable. Vulnerable versions of the HipChat for JIRA plugin were bundled by default with JIRA since JIRA version 6.3.5, up to but not including 6.4.11 (the fixed version).

Atlassian Cloud instances have already been upgraded to a version of the HipChat for JIRA plugin which does not have the issue described on this page.

Customers who have updated the HipChat For JIRA plugin to version 6.30.0 or higher are not affected.

Customers who have downloaded and installed JIRA >= 6.3.5 <  6.4.11 and have not updated the HipChat For JIRA plugin to 6.30.0 or higher should either update those instances of the HipChat For JIRA plugin for their JIRA installations in order to fix this vulnerability. 

Customers who have installed the HipChat For JIRA plugin in JIRA, and are running a version of the plugin equal to or above 1.3.2 and less than 6.30.0 should either update those instances of the HipChat For JIRA plugin or their JIRA installations to fix this vulnerability.  

Velocity Template Injection Vulnerability

Severity

Atlassian rates the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels. The scale allows us to rank a severity as critical, high, moderate, or low.

This is an independent assessment and you should evaluate its applicability to your own IT environment.

Description

We internally discovered that the HipChat For JIRA plugin had a resource that combined user input into a velocity template source and subsequently rendered it. Authenticated attackers can use this vulnerability to execute Java code of their choice on systems that have a vulnerable version of the HipChat For JIRA plugin enabled. To exploit this issue attackers need to be able to access the JIRA web interface and log into JIRA.

All versions of HipChat For JIRA plugin from 1.3.2 before 6.30.0 are affected by this vulnerability. 

All versions of JIRA from 6.3.5 before 6.4.11 are affected by this vulnerability. This issue can be tracked here:  JRA-44831 - Getting issue details... STATUS

Fix

We have taken the follow steps to address this issue:

1. Released a new version, 6.30.0, of the HipChat For JIRA plugin
2. Released JIRA version 6.4.11 that updates the bundled copy of the HipChat For JIRA plugin to a fixed version.

What You Need to Do

Upgrade (recommended)

The vulnerabilities and fix versions are described in the Description section above. Atlassian recommends that you upgrade to the latest version. 

Upgrade the HipChat for JIRA plugin to version 6.30.0 or higher. For instructions on how to update add-ons like the HipChat For JIRA plugin see https://confluence.atlassian.com/display/UPM/Updating+add-ons. The HipChat for JIRA plugin marketplace entry can be found at https://marketplace.atlassian.com/plugins/com.atlassian.labs.hipchat.hipchat-for-jira-plugin.

For a full description of the latest version of JIRA, see the release notes. You can download the latest version of JIRA from the download centre.

For instructions on how to update the HipChat For JIRA plugin see https://confluence.atlassian.com/display/UPM/Updating+add-ons.

Risk Mitigation

If you are unable to upgrade your JIRA server, then as a temporary workaround, you can disable or uninstall the HipChat For JIRA plugin in JIRA.

Support

If you have questions or concerns regarding this advisory, please raise a support request at https://support.atlassian.com/.

References