CVE-2021-25765
📋 TL;DR
This Cross-Site Request Forgery (CSRF) vulnerability in JetBrains YouTrack allows attackers to trick authenticated users into uploading malicious attachments without their consent. It affects YouTrack instances before version 2020.4.4701, potentially compromising data integrity and enabling further attacks.
💻 Affected Systems
- JetBrains YouTrack
📦 What is this software?
Youtrack by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Attackers could upload malicious files that execute code on the server, compromise user accounts, or exfiltrate sensitive data through crafted attachments.
Likely Case
Unauthorized file uploads leading to data manipulation, phishing payload delivery, or disruption of YouTrack functionality.
If Mitigated
With proper CSRF protections and input validation, the attack surface is minimized, though the vulnerability still exists in unpatched versions.
🎯 Exploit Status
Exploitation requires tricking an authenticated user into visiting a malicious webpage; no public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2020.4.4701 and later
Vendor Advisory: https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/
Restart Required: Yes
Instructions:
1. Backup YouTrack data. 2. Download and install YouTrack version 2020.4.4701 or later from the JetBrains website. 3. Restart the YouTrack service. 4. Verify the update by checking the version in the admin interface.
🔧 Temporary Workarounds
Implement CSRF Tokens
allManually add CSRF protection to attachment upload endpoints if customizing YouTrack.
Restrict Attachment Types
allConfigure YouTrack to block potentially dangerous file types (e.g., .exe, .js) via admin settings.
🧯 If You Can't Patch
- Deploy a Web Application Firewall (WAF) with CSRF protection rules.
- Isolate YouTrack instance behind a VPN or restrict access to trusted users only.
🔍 How to Verify
Check if Vulnerable:
Check the YouTrack version in the admin dashboard or via the API; if below 2020.4.4701, it is vulnerable.Check Version:
curl -s http://youtrack-instance/rest/admin/version | grep versionVerify Fix Applied:
Confirm the version is 2020.4.4701 or higher and test attachment uploads with CSRF attempts in a controlled environment.📡 Detection & Monitoring
Log Indicators:
- Unusual attachment uploads from unexpected IPs or user agents
- Failed CSRF token validation logs
Network Indicators:
- HTTP POST requests to attachment endpoints without referrer headers or CSRF tokens
SIEM Query:
source="youtrack.log" AND ("attachment upload" OR "CSRF") AND status=200