CVE-2017-18113 Code injection in Jira Data Center

High 8.8 Published 2 Aug 2021 Updated 17 Oct 2024

Remote attackers can execute arbitrary code by tricking administrators into importing malicious workflows in Jira Server and Data Center.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2017-18113?

CVE-2017-18113 is a high-severity code injection vulnerability in Atlassian Jira, published on 2 Aug 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution (RCE) vulnerability. The vulnerability allowed for various problematic OSWorkflow classes to be used as part of workflows. The fix for this issue blocks usage of unsafe conditions, validators, functions and registers that are build-in into OSWorkflow library and other Jira dependencies. Atlassian-made functions or functions provided by 3rd party plugins are not affected by this fix.

Weakness: CWE-94

Which versions are affected by CVE-2017-18113?

It affects 2 products.

Products include Atlassian Data Center, Atlassian Jira.

How do I fix CVE-2017-18113?

No fix has been published for CVE-2017-18113 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2017-18113 being exploited?

There is no known exploitation of CVE-2017-18113 in the wild and no public exploit code.

All Atlassian Jira vulnerabilities

Sources

Also known as GHSA-7q5w-8wg2-xwr7.