CVE-2019-9005

Vulnerability

The Cprime Power Scripts add-on for Atlassian Jira (versions before 4.0.14) contains a directory traversal vulnerability in its REST API. Specifically, the endpoints /rest/keplerrominfo/jjupin/2.0/wfviewer/filecheck and /rest/keplerrominfo/jjupin/2.0/wfviewer/filecontent do not properly validate user authorization, allowing any authenticated Jira user to probe for and read arbitrary files from the server filesystem [1]. The vulnerability exists because these endpoints, intended for administrator use, lack proper access control checks.

Exploitation

An attacker needs only a valid Jira user account (any privilege level) and network access to the Jira instance. The attacker can send crafted HTTP GET requests to the vulnerable endpoints with a path parameter containing directory traversal sequences (e.g., c:\Windows\win.ini on Windows or /etc/passwd on Linux). The filecheck endpoint returns a JSON response indicating whether the file exists, while filecontent returns the file's contents [1]. No additional user interaction or special privileges are required.

Impact

Successful exploitation allows an authenticated attacker to read arbitrary files from the Jira server's filesystem. This can lead to disclosure of sensitive information such as configuration files, credentials, source code, or other data stored on the server. The vulnerability does not allow file modification or code execution, but the information disclosure can be critical for further attacks [1].

Mitigation

The vendor released version 4.0.14 of Power Scripts to fix this vulnerability [1]. Users should upgrade to version 4.0.14 or later. No workarounds are documented; the fix adds proper authorization checks to the affected endpoints. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of this writing.