Unauthenticated Access to JIRA Admin Projects

Category: [Info Disclosure]

module name: check_unauthenticated_admin_projects

url: /rest/menu/latest/admin?maxResults=1000

[CG] These can be interesting in that it might show you that a target is also running Confluence or Bamboo or leak other domains/internal sites/

INFO: Checking for Unauthenticated Access to JIRA Admin Projects
[Testing URL]: http://JIRASERVER/rest/menu/latest/admin?maxResults=1000

+ Unauthenticated Access to JIRA Admin Projects Detected
  URL: http://JIRASERVER/rest/menu/latest/admin?maxResults=1000

  Admin Projects Details:
    - Key: admin
      Link: http://JIRASERVER/secure/project/BrowseProjects.jspa?s=view_projects
      Label: Jira administration
      Tooltip: 
      Local: True
      Self: True
      Application Type: jira

200 with Jira + Confluence

INFO: Checking for Unauthenticated Access to JIRA Admin Projects
[Testing URL]: https://JIRASERVER/jira/rest/menu/latest/admin?maxResults=1000

+ Unauthenticated Access to JIRA Admin Projects Detected
  URL: https://JIRASERVER/jira/rest/menu/latest/admin?maxResults=1000

  Admin Projects Details:
    - Key: admin
      Link: https://JIRASERVER/jira/secure/project/BrowseProjects.jspa?s=view_projects
      Label: JIRA
      Tooltip: 
      Local: True
      Self: True
      Application Type: jira
    - Key: admin
      Link: https://JIRASERVER/wiki/admin/console.action
      Label: Confluence
      Tooltip: 
      Local: False
      Self: False
      Application Type: confluence

401

INFO: Checking for Unauthenticated Access to JIRA Admin Projects
[Testing URL]: http://JIRASERVER/rest/menu/latest/admin?maxResults=1000

- No unauthenticated access to JIRA admin projects detected on: http://JIRASERVER/rest/menu/latest/admin?maxResults=1000
- HTTP Code: 401