# Abusing functionality to exploit a super SSRF in Jira Server (CVE-2022-26135)

Jira Mobile Plugin batch API concatenates user-supplied location into base URL, enabling authenticated full-read SSRF chainable with Service Desk signup for pre-auth exploitation.

- Payout: Research
- Severity: high
- Program: Atlassian Jira
- Credited: Assetnote
- Disclosed: 2024-01-31
- CVE: CVE-2022-26135
- Write-up quality: 8/10
- Original: https://www.assetnote.io/resources/research/abusing-functionality-to-exploit-a-super-ssrf-in-jira-server-cve-2022-26135
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-abusing-functionality-to-exploit-a-super-ssrf-in-jira-server-cve-2022-26135
- Tags: domain:web impact:internal-access kind:research platform:research sev:high tech:java technique:chained technique:source-review vuln:auth-bypass vuln:ssrf

**Target:** Jira Server Mobile Plugin REST batch endpoint /rest/nativemobile/1.0/batch
**Root cause:** LinkBuilder.forRelativePath concatenates jiraBaseUrls.baseUrl() + path via URI.create without validating the path, so a location like `@attacker.com` yields `https://jira-host.com@attacker.com` and OkHttp resolves the attacker host.
**Steps:**
1. Authenticate to Jira (or register via /servicedesk/customer/user/signup if signups enabled)
2. Send `POST /rest/nativemobile/1.0/batch` with JSON `{"requests":[{"method":"GET","location":"@example.com"}]}`
3. Server builds URL `https://jira-host.com@example.com` and OkHttp sends request to example.com
4. Control method, headers (copied from request), and body per batch entry; up to 5 requests per call
5. Use HTTP redirect to pivot protocol (e.g. https->http)
**How found:** Team was writing detection checks for an April 2022 Seraph auth-bypass advisory affecting the Mobile Plugin for Jira; while reverse-engineering the plugin's REST routes they read BatchResource/BatchServiceImpl and spotted the naive string concatenation in LinkBuilder.forRelativePath.
**Exploitation:** Chain: register account on Jira Service Desk signup endpoint, then use that session to call the batch API with `location: "@targethost"` to make arbitrary HTTP requests (any method/headers/body) from the Jira server, achieving full-read SSRF against internal services.
**Escalation:** Pre-auth exploitation achieved by abusing Service Desk self-signup to obtain a Jira Core account, bypassing the post-auth requirement of the SSRF.
**Insight:** When reviewing vendor patch advisories, enumerate every REST route in the affected plugin and trace user-controlled path parameters into URL builders; a `baseUrl + path` concatenation is exploitable via `@host` userinfo trick even when the path looks 'relative'.