---
title: "Security Advisory 2020-04-24 - Xray for Jira Server and Data Center"
canonical: "https://docs.getxray.app/space/XRAY/301469815/Security%20Advisory%202020-04-24%20-%20Xray%20for%20Jira%20Server%20and%20Data%20Center"
format: markdown
---
## Xray for Jira Server and Data Center - <span style="color: #172b4d">XXE vulnerability at XML result import</span>

| **Summary** | <span style="color: #172b4d">XXE vulnerability at result import (Test Run Result field)</span> |
| --- | --- |
| **Advisory Release Date** | 4/10/2020 10:00 AM CET |
| **Product** | Xray for Jira Server & Data Center<br>Xray for Jira Cloud customers are not affected. |
| **Affected on Xray for Jira Server & Jira Data Center Versions** | - All versions from 2.1.0 up to 3.6.2 |
| **Fixed on Xray Jira Server & Jira Data Center Versions** | - 3.6.3 |

### **Summary of Vulnerability**

This advisory discloses a **critical severity** security vulnerability which was present Xray versions of for Jira Server & Data Center from [2.1.0](https://confluence.xpand-it.com/display/XRAY/Xray+2.1.0+Release+Notes) until [3.6.3](https://confluence.xpand-it.com/display/XRAY/Xray+3.6.3+Release+Notes).** **Versions of Jira Server & Data Center affected by this vulnerability:

- from 2.1.0 to 3.6.2 (fixed in 3.6.3).

**Customers who have upgraded Xray for Jira Server & Data Center to version 3.6.3 or higher ****are** **<span style="color: #000000">not affected</span>****.**

**Customers who are on any of the affected versions, upgrade your Xray for Jira Server & Data Center installations immediately to fix this vulnerability.**

## <span style="color: #172b4d">XXE vulnerability at XML result import (Test Run Result field)</span>

#### **Severity**

We rate the severity level of this vulnerability as **critical**, according to the scale published in [Atlassian severity levels](https://www.atlassian.com/security/security-severity-levels). The scale allows us to rank the severity as critical, high, moderate, or low.

This is our assessment and you should evaluate its applicability to your own IT environment.

#### **Description**

<span style="color: #172b4d">There is an XXE vulnerability while using POST method of</span><span style="color: #172b4d"> </span>**any**<span style="color: #172b4d"> </span><span style="color: #172b4d">of the</span><span style="color: #172b4d"> </span>*import/execution/* XML*<span style="color: #172b4d"> </span><span style="color: #172b4d">endpoints which allows attackers to get read access to the filesystem on behalf of the user running Jira. </span>

<span style="color: #172b4d">Attackers are able to access filesystem by uploading a specific XML as result in any of the Xray endpoints accepting XML result files.</span>

This issue can be tracked here:  > Macro (jira)



### **Fix**

We have released Xray for Jira Server & DC version 3.6.3 which is available for upgrade through the Atlassian Marketplace.

## **What You Need to Do**

### **Upgrade**

You can upgrade to the latest version of Xray for Jira Server & Data Center using the Universal Plugin Manager as explained [in Updating apps](https://confluence.atlassian.com/upm/updating-apps-273875710.html). 

### **Mitigation**

#### Workaround 1 - Tomcat *(requires restart)*

Block the endpoint from being accessed directly in the Tomcat configuration files, only for the POST method:

1. Shut down the application, and backup your *$application-install/atlassian-jira/WEB-INF/web.xml* file
2. Add the following block inside the <web-app> element:
3. Restart the Jira application
4. If you try to send a POST request to the endpoint *<JIRA_BASE_URL>/rest/raven/1.0/import/execution *that accepts XML file format a 403 error with Jira HTML page stating that "Access to the requested resource has been denied" will be returned
  

#### Workaround 2 - Reverse Proxy

Block the endpoint from being accessed on the proxy server-side, only for the POST method (Tested on Apache HTTPD):

1. Open the virtual host configuration
2. `Add the following inside the virtual host to block the endpoint POST actions /rest/raven/1.0/import/execution/(junit|testng|nunit|robot)`
3. Ensure all connectors pass through the proxy
4. Restart Apache

:info: Example Virtual Host:

```xml
<VirtualHost *:80>

 	ServerName getxray.app

    ProxyRequests Off
    ProxyVia Off
     
    <Proxy *>
         Require all granted
    </Proxy>

    <LocationMatch "/rest/raven/1.0/import/execution/(junit|testng|nunit|robot)">
		Deny from all
	</LocationMatch>

	ProxyPass               /jira       http://localhost:8080/jira
	ProxyPassReverse        /jira       http://localhost:8080/jira

</VirtualHost>
```

### **Support**

If you have questions or concerns regarding this advisory, please raise a support request at [https://xraysupport.xpand-it.com/](https://xraysupport.xpand-it.com/).