CVE-2025-22173

Executive Summary

CVE-2025-22173 is an authorization vulnerability in Atlassian Jira Align that allows a low-privilege user to access unexpected endpoints, leading to the disclosure of a small amount of sensitive information. The vulnerability stems from missing or insufficient authorization checks on certain API endpoints, enabling an attacker with minimal privileges to view sprint data and other restricted details. No public exploit code or proof-of-concept is currently available, and the vendor has not yet released a patch. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains for organizations using Jira Align in sensitive environments.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unavailable)
• Attack Vector: Network (likely)
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None
• Threat Level: Medium (due to information disclosure potential)

Deep Dive & Mechanics

The vulnerability exists in Jira Align’s authorization framework. The application fails to enforce proper access controls on certain REST API endpoints, allowing authenticated users with low privileges (e.g., a team member role) to query endpoints that should be restricted to higher-privilege roles (e.g., project managers or administrators). The disclosed information includes sprint data such as sprint names, dates, and possibly task summaries, which could aid an attacker in reconnaissance or lateral movement.

The root cause is a missing or improperly implemented authorization check in the backend code. The affected endpoints likely lack a role-based access control (RBAC) validation, relying instead on implicit trust from the client-side application. This is a classic example of CWE-862 (Missing Authorization).

Vulnerable vs. Patched Code

No patch is available. The vulnerable code likely resembles:

// Vulnerable: No authorization check
@GET
@Path("/sprints")
public Response getSprints(@QueryParam("projectId") String projectId) {
    List<Sprint> sprints = sprintService.getSprints(projectId);
    return Response.ok(sprints).build();
}

A patched version would include an authorization check:

// Patched: Authorization check added
@GET
@Path("/sprints")
public Response getSprints(@QueryParam("projectId") String projectId, @Context SecurityContext securityContext) {
    if (!securityContext.isUserInRole("VIEW_SPRINTS")) {
        return Response.status(403).entity("Forbidden").build();
    }
    List<Sprint> sprints = sprintService.getSprints(projectId);
    return Response.ok(sprints).build();
}

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Identify Jira Align instances (e.g., via Shodan dorks: "Jira Align").
2. Authentication: Obtain low-privilege credentials (e.g., via phishing or default credentials).
3. Exploitation: Use a tool like curl to access the vulnerable endpoint:

   curl -X GET "https://target.com/rest/align/1.0/sprints?projectId=123" \
        -H "Authorization: Bearer <low_priv_token>"
   

4. Data Extraction: Parse the JSON response to extract sprint names, dates, and other metadata.

Blue Team

1. Detection: Monitor for unusual API calls from low-privilege users to sprint-related endpoints.
2. Honeypot: Deploy a fake Jira Align endpoint that logs all access attempts.
3. Mitigation: Implement network segmentation and restrict access to Jira Align to trusted IPs only.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /rest/align/1.0/sprints or similar endpoints from low-privilege users.
• Logs: Unauthorized access attempts to sprint data endpoints (HTTP 403 errors followed by successful 200 responses).
• User Agent: Unusual user agents (e.g., curl, python-requests) accessing API endpoints.

Detection Engineering

YARA Rule

rule Detect_JiraAlign_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2025-22173 in Jira Align"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $sprint_endpoint = "/rest/align/1.0/sprints"
        $low_priv_token = "Bearer [a-zA-Z0-9_-]+"
    condition:
        $sprint_endpoint and #low_priv_token > 0
}

Sigma Rule

title: Jira Align Unauthorized Sprint Access
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects low-privilege users accessing sprint endpoints in Jira Align
logsource:
    category: web
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/rest/align/1.0/sprints'
        cs-username: 'low_priv_user'
    condition: selection
falsepositives:
    - Legitimate admin testing
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-22173 Jira Align Sprint Data Exfiltration";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/rest/align/1.0/sprints"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Vendor Patch: Await an official patch from Atlassian. Monitor their security advisories.
2. Workaround: Implement a reverse proxy (e.g., Nginx) to block access to the vulnerable endpoints for low-privilege users:

   location /rest/align/1.0/sprints {
       deny all;
       return 403;
   }
   

3. Access Control: Review and tighten RBAC policies in Jira Align. Ensure that only necessary roles can access sprint data.
4. Monitoring: Enable detailed logging for API endpoints and set up alerts for unauthorized access attempts.
5. Network Segmentation: Place Jira Align behind a VPN or restrict access to trusted IP ranges.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert