CVE-2017-5983 Scanner

The JIRA Workflow Designer Plugin is a tool used within the Atlassian JIRA Server environment to design and manage workflows. It is widely used by teams to streamline processes and improve efficiency through customizable workflows. The plugin allows users to define rules and statuses, contributing to enhanced productivity in managing tasks and projects. By integrating directly with JIRA, it becomes an essential part of the software development and issue tracking lifecycle.

CVE-2017-5983 is a critical XML External Entity (XXE) vulnerability that arises when the plugin processes XML input without proper sanitization. This occurs because the XML parser is configured to resolve external entities, allowing attackers to inject malicious XML payloads. The vulnerability stems from unsafe deserialization practices and insufficient input validation in the plugin's XML handling routines.

Specifically, the vulnerability is triggered through the plugin's workflow import functionality, where XML files are parsed. An attacker can craft a malicious XML file containing external entities that reference local files or network resources. The vulnerable endpoint is typically found at /plugins/servlet/workflow-designer/import, which accepts XML data without adequate filtering.

If exploited, an attacker can achieve remote code execution on the JIRA server, read sensitive files such as configuration files or credentials, or perform server-side request forgery (SSRF) attacks. This can lead to full compromise of the JIRA instance and potentially the underlying infrastructure, impacting data confidentiality, integrity, and availability.