wordpress blog stats
Connect with us

Hi, what are you looking for?

Vulnerability in NASA’s Jira setting exposed details of a thousand users

Sensitive information such as internal user details, project details, employee names and mail IDs, was exposed through Jira, a web app that companies use for tracking tasks and issues, at the National Aeronautics and Space Administration aka NASA.

NCR based security researcher Avinash Jain, who shared the findings with MediaNama, found the vulnerability and reported it to NASA and the US Cert team on 3 September 2018. Jain said that the details of a thousand users were disclosed due to the vulnerability, which was quietly fixed three weeks after it was reported, on 25 September 2018.

However, the period for which the vulnerability existed (before Jain found it) is unclear.

Avinash Jain, Cybersecurity researcher who reported the bug

Explaining the issue, Jain said that there was an authorisation related misconfiguration in NASA’s Jira, which led to the disclosure of information. “In Jira, creating filters or dashboards provides some visibility option to set on them. The issue was due to the wrong permission assigned to them,” said Jain. He further explained:

“When the filters or dashboards set the visibility to ‘All users’ and ‘everyone’ respectively,” instead of sharing the information with everyone from the organisation, the filter shares the information with everyone publicly.

In a report with his findings, Jain lists various other sections of Jira that had exposed user information and their task related information to other internet users.

In his report, Jain said that this can give an attacker an idea about the kind of information housed within the application along with the details of the projects.

Picture credits: Avinash Jain

Picture credits: Avinash Jain

Picture credits: Avinash Jain

While CERT responded to Jain on 17 October, weeks after the bug was fixed, Jain said that he never heard from NASA despite writing to them 5 times. He was never personally notified when the bug was fixed, he said. The CERT team told him that it did not have a reward process for bug-finders. Jain laments that CERT and NASA don’t seem to have a dedicated, responsible team which appreciates ethical efforts, which leads to breaches by black hat hackers.

You May Also Like

News

Mobile numbers and WhatsApp chats of people using WhatsApp web were indexed on Google search results yet again, a security researcher claimed. This came...

News

The Ministry of Electronics and Information Technology wrote a letter to WhatsApp CEO Will Cathcart calling on the Facebook-owned messenger app to withdraw proposed...

News

Senior journalist and news anchor Nidhi Razdan was all set to start teaching at Harvard University this year. But it turns out she appears...

News

Google has closed its deal to acquire fitness wearables company Fitbit, even as probes by competition regulators in the United States and Australia are...

MediaNama is the premier source of information and analysis on Technology Policy in India. More about MediaNama, and contact information, here.

© 2008-2018 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ

Subscribe to Daily Newsletter

    © 2008-2018 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ