# Analysis of CVE-2019-14994 – Jira Service Desk Path Traversal leads to Massive Information Disclosure

Path traversal from Jira Service Desk customer portal to admin endpoints let any registered customer export all issues across every Jira project via JQL search.

- Payout: $11,000
- Severity: high
- Program: Atlassian
- Credited: Sam Curry
- Disclosed: 2019-09-25
- CVE: CVE-2019-14994
- Write-up quality: 7/10
- Original: https://samcurry.net/analysis-of-cve-2019-14994/
- Library page: https://bugbountylibrary.com/r/blog%3Asamcurry-net-analysis-of-cve-2019-14994
- Tags: domain:web impact:data-leak impact:internal-access kind:research platform:research sev:high tech:java technique:recon vuln:access-control vuln:auth-bypass vuln:path-traversal

**Target:** Jira Service Desk web application (/servicedesk/ and /secure/ endpoints)
**Root cause:** The customer portal path is not normalized before authorization checks, so `../` (or `..;/`) sequences in the URL escape the /servicedesk/ prefix and reach administrative endpoints like /secure/ and /sr/ that the customer should not access.
**Steps:**
1. Browse to `https://target.com/servicedesk/` to confirm Service Desk is present and a sign-up portal exists.
2. Register a customer account via the Sign up button and authenticate.
3. Send `GET /servicedesk/customer/../../secure/BrowseProjects.jspa` with the customer cookie; if 404 try `GET /servicedesk/customer/..;/..;/secure/BrowseProjects.jspa`.
4. Confirm the admin Browse Projects page renders, proving traversal.
5. Export data with `GET /servicedesk/customer/../../sr/jira.issueviews:searchrequest-html-all-fields/temp/SearchRequest.html?jqlQuery=text+%7E+%22%22` (or the `searchrequest-xml` variant) to dump all issues matching the JQL.
**How found:** Author notes the auth model redirects customers away from /secure/ and /sr/ by URL matching; hypothesis that path normalization differences could bypass the redirect led to trying `../` and `..;/` traversal in the customer portal path.
**Exploitation:** Attacker self-registers on the public customer portal, then uses `../` traversal in the /servicedesk/customer/ path to reach admin-only /secure/ and /sr/ endpoints. The /sr/ issue-views search endpoint accepts a jqlQuery parameter and returns all matching issues across all Jira projects as HTML or XML, giving a full data export with a single request.
**Escalation:** Single traversal request escalates from unauthenticated customer signup to full read of every Jira project's issues (Service Desk, Core, Software) on the instance.
**Insight:** When access control is enforced by matching the request URL prefix rather than the resolved resource, try `../` and Tomcat-style `..;/` traversal to reach sibling admin paths; then look for admin endpoints that take a query parameter (like JQL search) to turn a single traversal into a bulk data export.