Atlassian Jira - Path Traversal WAF Rule by crowdsecurity | CrowdSec Hub

Atlassian Jira - Path Traversal

WAF rulehttp:exploitcve.CVE-2021-26086CWE.22MITRE T1595MITRE T1190

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/vpatch-CVE-2021-26086

Atlassian Jira Server/Data Center 8.4.0 - Limited Remote File Read/Include (CVE-2021-26086)

Install with a top-level collection

1 collection include it

sudo cscli collections install ZoeyVid/npmplus

Installs 5 parsers and 54 scenarios, via WAF - Virtual Patching.

View NPMplus →

Installation

sudo cscli appsec-rules install crowdsecurity/vpatch-CVE-2021-26086

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

appsec-rules/crowdsecurity/vpatch-CVE-2021-26086.yaml· 34 linesGitHub

1name: crowdsecurity/vpatch-CVE-2021-26086
2description: "Atlassian Jira Server/Data Center 8.4.0 - Limited Remote File Read/Include (CVE-2021-26086)"
3rules:1
4  - or:
5      - zones:2
6          - URI
7        transform:3
8          - lowercase
9        match:4
10          type: contains
11          value: /;/web-inf/
12      - zones:2
13          - URI
14        transform:3
15          - lowercase
16        match:4
17          type: contains
18          value: /;/meta-inf/
19
20labels:5
21   type: exploit
22   service: http
23   confidence: 3
24   spoofable: 0
25   behavior: "http:exploit"
26   label: "Atlassian Jira - Path Traversal"
27   references:
28    - https://github.com/ColdFusionX/CVE-2021-26086
29    - https://nvd.nist.gov/vuln/detail/CVE-2021-26086
30   classification:
31     - cve.CVE-2021-26086
32     - CWE.22
33     - attack.T1595
34     - attack.T1190

Atlassian Jira - Path Traversal

Installation

Configuration

Installed on

Know where it runs