CVE-2023-22958

Vulnerability

The Syracom Secure Login plugin for Jira before version 3.1.1.0 contains an open redirect vulnerability in the 2FA PIN validation page. The target parameter of the endpoint plugins/servlet/twofactor/public/pinvalidation does not properly validate the redirect URL, allowing an attacker to specify an arbitrary external URL [1].

Exploitation

An attacker can craft a malicious link that, after the user successfully enters their 2FA PIN, redirects the user to an attacker-controlled website. The user must be authenticated to Jira and the 2FA session must be active. By luring the victim to click such a link (e.g., via phishing email), the attacker can redirect the authenticated user to a malicious site that mimics a legitimate Jira page [1].

Impact

Successful exploitation enables an attacker to perform phishing attacks against authenticated Jira users. The attacker can steal login credentials or other sensitive information by presenting a fake login page or by tricking the user into entering data on the malicious site [1].

Mitigation

The vulnerability is fixed in version 3.1.1.0 of the Secure Login plugin. Users should upgrade to this version or later. No workaround is documented in the available references [1].