CVE-2025-22172

Executive Summary

CVE-2025-22172 is an authorization vulnerability in Atlassian Jira Align that allows a low-privilege user to access unexpected endpoints, leading to the disclosure of a small amount of sensitive information. The vulnerability is classified as a Missing Authorization (CWE-862) issue. The CVSS score is currently 0.0, indicating that no official CVSS vector has been assigned. The EPSS score is 0.0%, suggesting low exploitation activity in the wild. No public proof-of-concept (PoC) or exploit code is available. The vendor has not released a patch or advisory, leaving the vulnerability unpatched.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary Atlassian product (Jira Align) and does not involve open-source package supply chain risks.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Not yet assigned)
• Attack Vector: Network (likely)
• Attack Complexity: Low (likely)
• Privileges Required: Low (confirmed)
• User Interaction: None (likely)
• Scope: Unchanged (likely)
• Confidentiality Impact: Low (disclosure of small amount of sensitive info)
• Integrity Impact: None
• Availability Impact: None
• Threat Level: Medium (due to low privilege requirement and potential for information disclosure)

Deep Dive & Mechanics

The vulnerability resides in the authorization layer of Jira Align. The application fails to properly enforce access controls on certain endpoints, allowing a user with low privileges (e.g., a standard user) to access endpoints that should require higher privileges (e.g., external reports). The exact endpoints are not publicly disclosed, but the impact is limited to reading external reports without the required permission. The vulnerability does not allow for data modification or privilege escalation.

Vulnerable vs. Patched Code

No specific code snippets are available. The vulnerability is a logic flaw in authorization checks. A patched version would include proper permission validation on the affected endpoints, ensuring that only users with the VIEW_EXTERNAL_REPORTS (or equivalent) permission can access them.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a vulnerable instance of Jira Align (version unknown). Create a low-privilege user account.
2. Reconnaissance: Identify endpoints that serve external reports. Common patterns include /rest/api/2/reports/external or similar.
3. Exploitation: As the low-privilege user, send a GET request to the identified endpoint. If the response returns report data, the vulnerability is confirmed.
4. Example Request:

   curl -X GET "https://jira-align.example.com/rest/api/2/reports/external/123" \
        -H "Authorization: Bearer <low_priv_token>"
   

Blue Team

1. Detection: Monitor for unauthorized access to report endpoints by low-privilege users. Look for HTTP 200 responses to endpoints that should return 403 for such users.
2. Mitigation: Implement strict access controls on all report endpoints. Use role-based access control (RBAC) and validate permissions server-side.
3. Hunting: Search logs for patterns like GET /rest/api/2/reports/external/ from users without the VIEW_EXTERNAL_REPORTS permission.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /rest/api/2/reports/external/ or similar endpoints from low-privilege users.
• Logs: Access logs showing 200 responses to restricted endpoints for unauthorized users.
• User Behavior: Low-privilege users accessing endpoints that are not part of their normal workflow.

Detection Engineering

YARA Rule

rule Detect_JiraAlign_AuthBypass {
    meta:
        description = "Detects attempts to exploit CVE-2025-22172 by accessing external report endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22172"
    strings:
        $endpoint = "/rest/api/2/reports/external/"
        $low_priv = "Authorization: Bearer" // Placeholder for low-privilege token pattern
    condition:
        $endpoint and #low_priv > 0
}

Sigma Rule

title: CVE-2025-22172 - Jira Align Authorization Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized access to external report endpoints in Jira Align
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-stem|contains: "/rest/api/2/reports/external/"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate access by users with proper permissions
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-22172 - Jira Align Authorization Bypass"; flow:to_server; content:"GET"; http_method; content:"/rest/api/2/reports/external/"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Restrict access to external report endpoints using network-level controls (e.g., WAF rules) until a patch is available.
2. Short-term: Implement additional authorization checks in the application code for all sensitive endpoints.
3. Long-term: Apply the official patch from Atlassian once released. Monitor Atlassian's security advisory page for updates.
4. Workaround: Disable external report functionality if not required, or restrict it to admin users only.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert