Unauthenticated RCE via Server-Side Template Injection in Atlassian Jira

CVE-2019-11581 is a critical Server-Side Template Injection (SSTI) vulnerability affecting multiple versions of Atlassian Jira Server. The flaw resides within the ContactAdministrators.jspa functionality, which allows unauthenticated users to submit a contact form to administrators. The application insecurely processes the subject parameter by passing it to the Velocity templating engine for rendering. An attacker can supply a malicious Velocity template string as the subject, which is then executed by the server, leading to full Remote Code Execution (RCE) with the privileges of the Jira service process. The vulnerability was confirmed via public proof-of-concept exploits that utilize Velocity engine introspection to call java.lang.Runtime.exec(). Defenders should prioritize patching, as the vulnerability requires no authentication and provides trivial access to the underlying host.

Attack Chain

1. Attacker navigates to the public-facing endpoint /secure/ContactAdministrators.jspa on a vulnerable Jira Server instance.
2. Attacker crafts a malicious HTTP POST request targeting the ContactAdministrators form.
3. The subject parameter in the request body is populated with a Velocity template payload (e.g., $i18n.getClass().forName('java.lang.Runtime')...).
4. The request is processed by the JiraWebworkActionDispatcher and routed to the ContactAdministrators.doExecute() method.
5. The application triggers EmailBuilder.renderLater(), which eventually calls DefaultVelocityTemplatingEngine.render().
6. The Velocity engine parses the malicious subject string as a template, invoking the injected Java reflection code.
7. The system executes the arbitrary command, granting the attacker RCE on the server.

Impact

Successful exploitation results in full server compromise, allowing attackers to execute arbitrary system commands, exfiltrate sensitive Jira data, or use the compromised host as a pivot point in the internal network. The vulnerability impacts Atlassian Jira Server versions below 7.6.14, 7.13.5, 8.0.3, 8.1.2, and 8.2.3.

Recommendation

1. Immediately upgrade all Atlassian Jira Server instances to the patched versions specified by Atlassian (7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 or higher).
2. If immediate patching is not possible, disable the Contact Administrators Form functionality via the application properties administration panel.
3. Deploy the Sigma rules below to monitor web logs for suspicious POST requests containing Velocity template syntax.
4. Review access logs for non-standard or unexpected POST requests to /secure/ContactAdministrators.jspa.