3 ms·

TL;DR: > by default the visibility is set to “All users” and “Everyone” respectively, which instead of sharing with everyone of the organizations (which people

by lucb1e 7y ago

TL;DR: > by default the visibility is set to “All users” and “Everyone” respectively, which instead of sharing with everyone of the organizations (which people think and interpret), it share them publically [sic] To test if you are vulnerable, check whether you can publicly load one of these URIs on your domain: https://jira.example.com/secure/popups/UserPickerBrowser.jspa https://jira.example.com/secure/ManageFilters.jspa?filterView=popular https://jira.example.com/secure/ConfigurePortalPages!default.jspa?view=popular To find these sites, Google one of these queries: inurl:/UserPickerBrowser.jspa -intitle:Login -intitle:Log inurl:/ManageFilters.jspa?filterView=popular AND ( intext:All users OR intext:Shared with the public OR intext:Public )

vesrah 7y ago
The way to test yours is with these links: https://companyname.atlassian.net/secure/popups/UserPickerBrowser.jspa https://companyname.atlassian.net/secure/popups/UserPickerBr... https://companyname.atlassian.net/secure/ManageFilters.jspa?filterView=popular https://companyname.atlassian.net/secure/ManageFilters.jspa?... https://companyname.atlassian.net/secure/ConfigurePortalPages!default.jspa?view=popular https://companyname.atlassian.net/secure/ConfigurePortalPage...
- lucb1e 7y ago
  If you have jira as saas, sure. Ours is self hosted.
Karunamon 7y ago
It gets worse. You can modify those permissions, but every single Jira page that involves a permission check (and they get pretty granular) involves a nontrivial query to the user DB (which might, itself, involve a query to a backend like LDAP) to determine if you can do a thing or, critically, see the UI element to do the thing. Best guidance when I was running Jiras were to restrict access at the network if at all possible, and don't use permissions any more than strictly necessary unless you like 5-10 seconds per page load. In other words, if only your developers need to see your Jira, don't grant only your developer group permissions, set it to "everyone" and lock everyone else out at the firewall.
- vultour 7y ago
  We run massive JIRA instances with very granular permissions using multiple custom authorization backends (LDAP/Kerberos/in-house stuff), and it doesn't seem to add much of a delay.
  - Karunamon 7y ago
    Hm. Perhaps they took some time and worked on the performance then. It was ungodly slow a couple years back, and relaxing permissions led to a significant performance boost.
    - bearer_token 7y ago
      They've been touting performance increases for a while now https://confluence.atlassian.com/jirasoftware/jira-software-8-0-x-release-notes-957981626.html#JiraSoftware8.0.xreleasenotes-performance https://confluence.atlassian.com/jirasoftware/jira-software-...

by lucb1e 7y ago

vesrah 7y ago

The way to test yours is with these links: https://companyname.atlassian.net/secure/popups/UserPickerBrowser.jspa https://companyname.atlassian.net/secure/popups/UserPickerBr... https://companyname.atlassian.net/secure/ManageFilters.jspa?filterView=popular https://companyname.atlassian.net/secure/ManageFilters.jspa?... https://companyname.atlassian.net/secure/ConfigurePortalPages!default.jspa?view=popular https://companyname.atlassian.net/secure/ConfigurePortalPage...

lucb1e 7y ago
If you have jira as saas, sure. Ours is self hosted.

Karunamon 7y ago

It gets worse. You can modify those permissions, but every single Jira page that involves a permission check (and they get pretty granular) involves a nontrivial query to the user DB (which might, itself, involve a query to a backend like LDAP) to determine if you can do a thing or, critically, see the UI element to do the thing. Best guidance when I was running Jiras were to restrict access at the network if at all possible, and don't use permissions any more than strictly necessary unless you like 5-10 seconds per page load. In other words, if only your developers need to see your Jira, don't grant only your developer group permissions, set it to "everyone" and lock everyone else out at the firewall.

vultour 7y ago
We run massive JIRA instances with very granular permissions using multiple custom authorization backends (LDAP/Kerberos/in-house stuff), and it doesn't seem to add much of a delay.
- Karunamon 7y ago
  Hm. Perhaps they took some time and worked on the performance then. It was ungodly slow a couple years back, and relaxing permissions led to a significant performance boost.
  - bearer_token 7y ago
    They've been touting performance increases for a while now https://confluence.atlassian.com/jirasoftware/jira-software-8-0-x-release-notes-957981626.html#JiraSoftware8.0.xreleasenotes-performance https://confluence.atlassian.com/jirasoftware/jira-software-...