CVE-2015-5603: JIRA and the HipChat For JIRA plugin - Velocity Template Injection

Note: the current version of this advisory can be found at
https://confluence.atlassian.com/x/IcBKLg .

CVE ID: CVE-2015-5603
Product: JIRA and the HipChat for JIRA plugin.
Affected HipChat For JIRA plugin versions: 1.3.2 <= version < 6.30.0
Affected JIRA product versions: 6.3.5 <= version < 6.4.11

Summary:
This advisory discloses a critical severity security vulnerability
that was introduced in version 1.3.2 of the HipChat for JIRA plugin.
Versions of the HipChat for JIRA plugin starting with 1.3.2 before
6.30.0 (the fixed version) are vulnerable. Vulnerable versions of the
HipChat for JIRA plugin were bundled by default with JIRA since JIRA
version 6.3.5, up to but not including 6.4.11 (the fixed version).

Atlassian Cloud instances have already been upgraded to a version of
the HipChat for JIRA plugin which does not have the issue described in
this email.

Customers who have updated the HipChat For JIRA plugin to version
6.30.0 or higher are not affected.

Customers who have downloaded and installed JIRA >= 6.3.5 < 6.4.11
and have not updated the HipChat For JIRA plugin to 6.30.0 or higher
should either update those instances of the HipChat For JIRA plugin
for their JIRA installations in order to fix this vulnerability.

Customers who have installed the HipChat For JIRA plugin in JIRA, and
are running a version of the plugin equal to or above 1.3.2 and less
than 6.30.0 should either update those instances of the HipChat For
JIRA plugin or their JIRA installations to fix this vulnerability.

Severity:
Atlassian rates the severity level of this vulnerability as critical,
according to the scale published in our Atlassian severity levels
(https://www.atlassian.com/security/security-severity-levels&#41;. The
scale allows us to rank a severity as critical, high, moderate, or
low.
This is an independent assessment and you should evaluate its
applicability to your own IT environment.

Description:
We internally discovered that the HipChat For JIRA plugin had a
resource that combined user input into a velocity template source and
subsequently rendered it. Authenticated attackers can use this
vulnerability to execute Java code of their choice on systems that
have a vulnerable version of the HipChat For JIRA plugin enabled. To
exploit this issue attackers need to be able to access the JIRA web
interface and log into JIRA.

All versions of HipChat For JIRA plugin from 1.3.2 before 6.30.0 are
affected by this vulnerability.

All versions of JIRA from 6.3.5 before 6.4.11 are affected by this
vulnerability. This issue can be tracked here:
https://jira.atlassian.com/browse/JRA-44831

Fix:
We have taken the follow steps to address this issue:
Released a new version, 6.30.0, of the HipChat For JIRA plugin
Released JIRA version 6.4.11 that updates the bundled copy of the
HipChat For JIRA plugin to a fixed version.

Remediation:
Upgrade the HipChat for JIRA plugin to version 6.30.0 or higher. For
instructions on how to update add-ons like the HipChat For JIRA plugin
see https://confluence.atlassian.com/display/UPM/Updating+add-ons.
Optionally upgrade JIRA to version 6.4.11 which bundles a fixed
version of the HipChat For JIRA plugin.

Risk Mitigation:
If you are unable to upgrade your JIRA server or the HipChat for JIRA
plugin, then as a temporary workaround, you can disable or uninstall
the HipChat For JIRA plugin in JIRA.

Support:
If you have questions or concerns regarding this advisory, please
raise a support request at https://support.atlassian.com/ .

–
David Black / Security Engineer.