JIRA
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Inside a Jira instance any user (even non-authenticated) can check its privileges in
/rest/api/2/mypermissions or /rest/api/3/mypermissions . These endpoints will return your current privileges.
If a non-authenticated user have any privilege, this is a vulnerability (bounty?).
If an authenticated user have any unexpected privilege, this a a vuln.#Check non-authenticated privileges
curl https://jira.some.example.com/rest/api/2/mypermissions | jq | grep -iB6 '"havePermission": true'
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Last modified 4mo ago