CVE-2019-11580
Published: 03 June 2019
Summary
CVE-2019-11580 is a critical-severity an unspecified weakness vulnerability in Atlassian Crowd. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and CM-7 (Least Functionality).
Deeper analysis
Atlassian Crowd and Crowd Data Center versions from 2.1.0 through 3.4.3 contain a misconfiguration in which the pdkinstall development plugin remains enabled in release builds. This component accepts plugin installation requests without proper restrictions, directly exposing the application to arbitrary code deployment on the underlying server.
Unauthenticated attackers can send HTTP requests to the affected pdkinstall endpoint to upload and activate malicious plugins. Successful exploitation grants remote code execution with the privileges of the Crowd process, allowing full compromise of confidentiality, integrity, and availability as reflected in the CVSS 9.8 score.
The vendor advisory at https://jira.atlassian.com/browse/CWD-5388 identifies fixed releases (3.0.5, 3.1.6, 3.2.8, 3.3.5, and 3.4.4) and recommends immediate upgrade. Public exploit code published on Packet Storm demonstrates practical remote code execution against unpatched instances, confirming the issue has been weaponized in the wild.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-3250
Vulnerability details
Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins,…
more
which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prohibits enabling non-essential development components such as pdkinstall in production Crowd builds, eliminating the exposed plugin-install endpoint.
Requires applying secure configuration settings that disable the pdkinstall development plugin and enforce least-functionality defaults in release builds.
Enforces access restrictions on software-change operations, blocking unauthenticated or unauthorized requests to install arbitrary plugins via the exposed endpoint.