Release: Merge release into master from: release/2.55.1

[github-actions]

Release triggered by Maffooch

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request modifies dojo/jira_link/views.py and includes sensitive-path edits, introduces a potential server-side request forgery (SSRF) where an unvalidated, user-controlled issue_id is concatenated into a Jira URL and requested, and exposes webhook/IDOR weaknesses by relying on a global URL secret and allowing attacker-controlled Jira payloads to alter findings (including status, reviewer, and timestamps). These changes raise security concerns around SSRF, webhook integrity, and audit tampering and should be reviewed and mitigated (input validation, allowlisting, stronger authentication, and stricter access controls) before merging.

🔴 Configured Codepaths Edit in dojo/jira_link/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🟡 Potential Server-Side Request Forgery (SSRF) in dojo/jira_link/views.py

Vulnerability

Potential Server-Side Request Forgery (SSRF)

Description

User-controlled value 'issue_key' (issue_id) from jform.cleaned_data is concatenated into an HTTP URL and passed directly to jira._session.get(key_url) with no validation, allowlist, or scheme/host/IP checks. The code builds key_url as jira_server.strip("/") + "/rest/api/latest/issue/" + issue_id + "/transitions?expand=transitions.fields" and issues an HTTP request; an attacker who can control issue_key could inject values that alter the request target (for example by including path traversal-like content or special encodings) leading to SSRF to unintended hosts. There is no DNS/IP resolution validation or redirect protection visible in the surrounding code.

django-DefectDojo/dojo/jira_link/views.py

Lines 351 to 353 in 9778f34

	issue_id = jform.cleaned_data.get("issue_key")
	key_url = jira_server.strip("/") + "/rest/api/latest/issue/" + issue_id + "/transitions?expand=transitions.fields"
	response = jira._session.get(key_url).json()

Insecure Direct Object Reference (IDOR) / Webhook Integrity in dojo/jira_link/views.py

Vulnerability

Insecure Direct Object Reference (IDOR) / Webhook Integrity

Description

The Jira webhook endpoint in dojo/jira_link/views.py lacks robust integrity checks and suffers from an IDOR vulnerability. It relies on a global shared secret passed in the URL, which is the only form of authentication. Once this secret is known (or if it is disabled via configuration), an attacker can spoof webhook requests. The handler extracts a Jira issue ID (jid) directly from the user-controlled JSON payload and uses it to locate and modify associated findings in DefectDojo. The code in this hunk specifically adds an update to the finding's last_reviewed and last_reviewed_by fields, allowing an attacker to manipulate audit trails. Furthermore, related logic in the webhook handler allows an attacker to change finding statuses (e.g., to Mitigated or Risk Accepted) and backdate mitigation timestamps.

django-DefectDojo/dojo/jira_link/views.py

Lines 288 to 291 in 9778f34

	finding.last_reviewed = new_note.date
	finding.last_reviewed_by = author
	# Only update the timestamp fields, not other fields like 'active' to avoid
	# race conditions with concurrent webhook events (e.g. issue_updated)

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.