CVE-2017-16861 Code injection in Fisheye and Crucible
Attackers can execute arbitrary Java code via double OGNL evaluation in redirect actions or JSP tags, compromising Fisheye and Crucible servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-16861?
CVE-2017-16861 is a critical code injection vulnerability in Atlassian Crucible, published on 1 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Fisheye or Crucible. All versions of Fisheye and Crucible before 4.4.5 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.2 (the fixed version for 4.5.x) are affected by this vulnerability.
Which versions are affected by CVE-2017-16861?
It affects 2 products.
Products include Atlassian Crucible, Atlassian Fisheye.
How do I fix CVE-2017-16861?
No fix has been published for CVE-2017-16861 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-16861 being exploited?
There is no known exploitation of CVE-2017-16861 in the wild and no public exploit code.
Other vulnerabilities in Atlassian Crucible
Sources
Also known as GHSA-cv2h-wxc2-2v4j.