Title: Server-Side Request Forgery (SSRF) in Jira Attachment Import

Severity: HIGH
CWE: CWE-918 (Server-Side Request Forgery)
CVSS 3.1 Score: 7.5 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)

AFFECTED COMPONENT:

File: app/services/import/jira_client.rb
Lines: 226-244
Function: download_attachment()

VULNERABLE CODE:

def download_attachment(content_url)
  case (response = @httpx.get(content_url))          # <-- NO SSRF PROTECTION
  in { status: 200..299 }
    response.body
  in { status: 300..399 }
    case (redirect_response = @httpx.get(response.headers["location"]))  # <-- ALSO VULNERABLE
    in { status: 200..299 }
      redirect_response.body
    in { status: 300.. }
      raise "BAD RESPONSE: #{redirect_response.status}, #{redirect_response.body}"
    in { error: error }
      raise error
    end
  in { status: 400.. }
    raise "BAD RESPONSE: #{response}"
  in { error: error }
    raise error
  end
end

VULNERABILITY DESCRIPTION:

The JiraClient service fetches attachment content from URLs provided in the Jira
API response. The content_url parameter is directly passed to @httpx.get()
without any validation or SSRF protection.

An attacker who controls a malicious Jira server (or can manipulate the Jira
API response) can specify internal URLs that the OpenProject server will fetch:

• Internal services: http://localhost:8080/admin
• AWS Metadata: http://169.254.169.254/latest/meta-data/
• Internal APIs: http://192.168.1.100:8000/internal/api
• Cloud services: http://metadata.google.internal/

IMPACT:

1. Port scanning internal network infrastructure
2. Accessing internal services and APIs not exposed to the internet
3. Reading AWS/GCP/Azure cloud metadata (credentials, tokens)
4. Bypassing firewall restrictions
5. Information disclosure from internal systems

EXPLOITATION SCENARIO:

1. Attacker configures a malicious "Jira" connection in OpenProject
2. Points it to attacker's controlled Jira server
3. Creates an issue with an attachment
4. The attachment URL points to internal resources (e.g., http://169.254.169.254/)
5. OpenProject fetches the attachment, exposing internal data

REMEDIATION:

Use the existing OpenProject::SsrfProtection class which is already implemented
for webhooks but not used here:

def download_attachment(content_url)
  # Use SSRF-protected HTTP request
  response = OpenProject::SsrfProtection.get(content_url)
  # ... rest of the code
end

STATUS: UNPATCHED (as of version 17.3.0)