Atlassian JIRA Servicedesk misconfiguration
Description
Atlassian JIRA Service Desk is a widely-used IT service management and customer support platform. This vulnerability occurs when JIRA Service Desk is misconfigured to allow unrestricted public user registration through the /servicedesk/customer/user/signup endpoint. When this setting is enabled without proper access controls, unauthorized users can create accounts and gain access to internal service desk portals, potentially exposing sensitive support tickets, customer information, and internal communications.
Remediation
Immediately restrict public signup access to your JIRA Service Desk instance by following these steps:<br/><br/><strong>1. Review Customer Access Settings:</strong><br/>• Navigate to <strong>Project settings → Customer permissions</strong> in your JIRA Service Desk project<br/>• Review the "Who can raise requests?" setting<br/><br/><strong>2. Disable Public Signup:</strong><br/>• Change the customer access setting from "Anyone" or "Anyone with access to the Jira site" to "Only people you invite or add to this project"<br/>• Alternatively, configure "Anyone in these domains" and specify only trusted email domains<br/><br/><strong>3. Disable Global Signup (if applicable):</strong><br/>• Go to <strong>Administration → User management → User signup options</strong><br/>• Ensure "Public signup" is disabled for the entire JIRA instance<br/><br/><strong>4. Audit Existing Accounts:</strong><br/>• Review recently created customer accounts for suspicious registrations<br/>• Remove any unauthorized accounts and review tickets they may have accessed<br/><br/><strong>5. Implement Additional Controls:</strong><br/>• Enable CAPTCHA for signup pages if public access is required<br/>• Implement email domain restrictions to limit registration to known partners or customers<br/>• Enable audit logging to monitor account creation and access patterns<br/><br/>Consult the official Atlassian documentation (referenced above) for detailed configuration guidance specific to your JIRA Service Desk version.