CVE-2017-9506: Atlassian OAuth Plugin IconUriServlet SSRF and XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityHigh EPSS and public exploit references make exploitation likely, though the CVSS score is medium and user interaction is required for the XSS component.

What it is

The IconUriServlet in the Atlassian OAuth Plugin (1.3.0 before 1.9.12, and 2.0.0 before 2.0.4) is vulnerable to server-side request forgery. An attacker can make the server fetch internal network resources and can also trigger reflected XSS through the same endpoint, exposing internal services and user sessions.

Impact

An attacker gains the ability to read content from internal network resources reachable by the Atlassian server and to execute script in a victim's browser session. This can expose internal services and enable session or credential theft via XSS.

Attack surface

Reachable over the network through the IconUriServlet endpoint with no authentication required, but the CVSS vector indicates user interaction is required, consistent with the XSS component. The SSRF portion is server-side and driven by attacker-supplied URI input.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.716 probability, 99.4th percentile) and multiple references are tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade the Atlassian OAuth Plugin to 1.9.12 or later in the 1.x line, or 2.0.4 or later in the 2.x line.
• Restrict outbound network access from Atlassian servers to only required destinations to limit SSRF reach.
• Apply input validation or allowlisting on the IconUriServlet URI parameter if the plugin cannot be patched immediately.
• Deploy a WAF rule to block requests to the IconUriServlet carrying internal or unexpected URI targets.
• Review and rotate any credentials or tokens that may have been exposed through internal resource access.

Detection

• Monitor Atlassian server logs for IconUriServlet requests containing internal IP addresses, localhost, or metadata endpoints.
• Alert on outbound connections from Atlassian hosts to internal RFC1918 ranges or cloud metadata addresses.
• Search web logs for reflected script payloads in IconUriServlet query parameters indicating XSS attempts.
• Correlate unusual IconUriServlet access with subsequent authentication or session anomalies.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.