-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID: SYSS-2019-043
Product: In-App & Desktop Notification for Jira
Manufacturer: Infosysta
Affected Version(s): 1.6.13_J8
Tested Version(s): 1.6.13_J8
Vulnerability Type: Authentication/Authorization Bypass
Risk Level: Medium
Solution Status: Closed
Manufacturer Notification: 2019-09-24
Solution Date: 2019-10-01
Public Disclosure: 2019-10-23
CVE Reference: CVE-2019-16907
Author of Advisory:
Erik Steltzner, SySS GmbH
Luna Krone, SySS GmbH
Sascha Heider, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

In-App & Desktop Notification for Jira is a Plug-in that displays email notification
from Jira directly within the application.

The manufacturer describes the product as follows (see [1]):

"In-app & Desktop Notifications for Jira app allows you to get all of Jira's
email notifications in front of you. Now you won't have to search through all
your emails to check for a specific event in Jira, but all what you need to do
is to check the notification section in Jira and see all events that happened
in Jira and are related to you.
You will also receive instant Desktop notifications as well as you will be able
to add comments to the tickets directly from the notification."

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

It is possible to read out all user names within Jira without authentication/authorization.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

Using the following path it is possible to list all existing user names:
/plugins/servlet/nfj/UserFilter?searchQuery=@

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Before delivering a reply, it should be checked whether a
request has the necessary authorization.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2019-09-10: Vulnerability discovered
2019-09-24: Vulnerability reported to manufacturer
2019-10-01: Patch released by manufacturer
2019-10-23: Public disclosure of vulnerability

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for In-App & Desktop Notification for Jira
    https://marketplace.atlassian.com/apps/1217434/in-app-desktop-notifications-for-jira
[2] SySS Security Advisory SYSS-2019-043
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-043.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/news/responsible-disclosure-policy/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Erik Steltzner, Luna Krone and Sascha Heider
of SySS GmbH.

E-Mail: erik.steltzner@syss.de
Public Key: ://www.syss.de/fileadmin/dokumente/PGPKeys/Erik_Steltzner.asc
Key ID: 0x4C7979CE53163268
Key Fingerprint: 6538 8216 555B FBE7 1E01 7FBD 4C79 79CE 5316 3268

E-Mail: luna.krone@syss.de
Public Key: ://www.syss.de/fileadmin/dokumente/PGPKeys/Luna_Krone.asc
Key ID: 0x31764595D77A53F2
Key Fingerprint: C7AF 1259 B763 D588 E8D2 B302 3176 4595 D77A 53F2

E-Mail: sascha.heider@syss.de
Public Key: ://www.syss.de/fileadmin/dokumente/PGPKeys/Sascha_Heider.asc
Key ID: 0x06C4F8D7FCE9AF94
Key Fingerprint: F99E 89B8 EF77 C34F 6F9F 0E19 06C4 F8D7 FCE9 AF94

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" 
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web
site.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: https://creativecommons.org/licenses/by/3.0/deed.en

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEx68SWbdj1Yjo0rMCMXZFldd6U/IFAmeXkjoACgkQMXZFldd6
U/L4UA//Uo9cXicnF2IqfXvi6CZl/eRqvpM2NV+J4vb2vf2MQLyoasIA9x6jSSLf
/Goh0vR6NCXMzeelAOUNC+vTrryn1FjxLhu0uh79b3rVlPWFvrJrYx94qkmHMLQ9
r8yY9mM6dOl18WYbWo+cZ3/J0ERRkIV6mwgvmuDvBhP3mUER7Ya6Fv87GzUfiSMl
HA+vq1cfZnE1f4A2p6vpjXbuiamZucvyRZoueJVoR1YZJzb/hSYdZj0x/6LFITYA
XvKCfUIEik7zZVU7gonXxOb2KOqYW4ylohGVp9dD6EEzQ1/Ak6dC/j94maOlgYeL
N6NttsOqOd44+oBPueyMj/sYyqAIszlYtr+A67qBwUNTeqpuWV9BIV//l293QTpv
Rj/ittOHrtjWpOZ4Zy1a5S+9DpEgoE50eoWxld463GY3Q8cmTA7iHKJtJ893EcXs
vmxr8n39VlEWeEqMpE0jxDwQ4SnSEA9RH+QBcve07nuufA8SKFYnSmFcVfGAvBKN
8WtNcJxP5m0jemL809cQNTDP6BlwiCoqKfKGtcmrCNOKaUUP4jBSEDrdKmWIeIdQ
BmzNUBwpy3Xqd/6Nxg59v6yyF8Dwx6MsDqJ9E3OXdNVgOcxb0hr6RHXATfZUi77A
40LLKDwY/PQR0BseXYjJUofAIyeqAgJbmCrPMAx8YIQJQJOCzjs=
=ve5F
-----END PGP SIGNATURE-----