Vulnerability Report

CVE-2017-9506

Title: Atlassian Oauth Server-Side Request Forgery (SSRF)

SSRF

Proof Of Concept

No public PoC currently indexed for CVE-2017-9506.

CWE Category CWE-918

Published Date Aug 23, 2017

Modified Date Jun 17, 2026

Exploit Status Not Found

Score 6.1 CVSS v3.0

Exploit Probability (EPSS)

71.60%

Vulnerability Summary

CVE-2017-9506: The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).

Impacted Vendors

atlassian 1

Reference Links

http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html https://ecosystem.atlassian.net/browse/OAUTH-344 https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3 https://twitter.com/Zer0Security/status/983529439433777152 https://twitter.com/ankit_anubhav/status/973566620676382721 http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html https://ecosystem.atlassian.net/browse/OAUTH-344 https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3 https://twitter.com/Zer0Security/status/983529439433777152 https://twitter.com/ankit_anubhav/status/973566620676382721

CVSS v3.0

Source Entity [email protected]

Severity MEDIUM

6.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

4.3

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:N/C:N/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns