CVE-2022-0540: 
JIRA vulnerability analysis and mitigation

A critical vulnerability (CVE-2022-0540) was discovered in Jira's web authentication framework, Jira Seraph, that allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. The vulnerability affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0, as well as Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0. The vulnerability was discovered by Khoadha of Viettel Cyber Security and disclosed on April 20, 2022 (Atlassian Advisory).

The vulnerability exists in the core of Jira but specifically affects first and third-party apps that specify roles-required at the webwork1 action namespace level and do not specify it at an action level. For an action to be vulnerable, it must also not perform any other authentication or authorization checks. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The impact varies depending on the installed apps and their configurations. For installations using apps with affected configurations, Atlassian rates the severity as critical, though this may vary if an affected app uses additional permissions checks. For installations without any affected apps, the severity is rated as medium. Two notable bundled Atlassian apps are affected: Insight - Asset Management and Mobile Plugin for Jira, with Insight being vulnerable to arbitrary code execution if an authenticated user has object schema manager permissions (Atlassian FAQ).

The primary mitigation is to install a fixed version of Jira or Jira Service Management. Fixed versions include 8.13.18+, 8.20.6+, and 8.22.0+ for Jira, and 4.13.18+, 4.20.6+, and 4.22.0+ for Jira Service Management. If unable to upgrade immediately, administrators can update affected apps to non-vulnerable versions or, as a last resort, disable affected apps. However, Insight - Asset Management should not be disabled on Jira Service Management versions 4.19.x and 4.20.x < 4.20.3 as it will cause all of Jira Service Management to be disabled (Atlassian Advisory).