CVE-2019-11581

What it actually does

Server-side template injection in the ContactAdministrators and SendBulkMail actions allows unauthenticated remote attackers to execute arbitrary code by supplying malicious template expressions that are evaluated on the server.

Why it matters to the business

Attackers can fully compromise the Jira server, leading to theft of sensitive project data, disruption of issue tracking workflows, and potential lateral movement into connected systems; the flaw remains actively exploited in the wild with a CISA remediation deadline that has already passed.

How an attack unfolds

An attacker sends crafted HTTP requests to the vulnerable ContactAdministrators or SendBulkMail endpoints, embedding template injection payloads that execute operating-system commands or spawn a reverse shell; once code execution is achieved, the attacker can install persistence, exfiltrate data, or pivot further into the environment.

How to fix it

Upgrade Jira Server and Data Center to fixed releases 7.6.14, 7.13.5, 8.0.3, 8.1.2, or 8.2.3 (or later) depending on the current major version; if immediate upgrade is not possible, restrict network access to administrative endpoints and apply web application firewall rules to block template syntax in request parameters.

How to confirm the fix worked

Verify the running Jira version is at or above one of the fixed releases; re-test the ContactAdministrators and SendBulkMail actions with benign template expressions to confirm they no longer evaluate server-side; monitor vendor release notes for any backported fixes.

Typical attack path

1. Identify publicly reachable Jira Server or Data Center instance
2. Send unauthenticated HTTP POST to /secure/ContactAdministrators!default.jspa or /secure/admin/SendBulkMail!default.jspa containing template injection payload
3. Achieve remote code execution and establish reverse shell or web shell
4. Escalate privileges, dump credentials, and move laterally

How to detect it

Search web server and application logs for requests to the ContactAdministrators or SendBulkMail actions containing template delimiters such as ${, #{, or *{; inspect for unusual process spawns (e.g., cmd.exe, bash) originating from the Jira process; review authentication and access logs around the time of suspicious requests for signs of post-exploitation activity.

• /secure/ContactAdministrators!default.jspa
• /secure/admin/SendBulkMail!default.jspa
• ${
• #{
• *{

What your security team should do

• Immediately upgrade all affected Jira instances to the fixed versions listed above
• Block or tightly restrict external access to /secure/ContactAdministrators and /secure/admin/SendBulkMail paths
• Hunt for historical exploitation using the provided detection guidance and IOCs
• Review and harden administrative interfaces across the Atlassian ecosystem