• Type: Bug
• Resolution: Fixed
• Priority: High
• Fix Version/s: 3.0
• Affects Version/s: 2.10
• Component/s: None
• Labels:

  • affects-server
  • security
• Environment:

  QA-CAC: 3.0-beta2-r3

[CONFSERVER-15754] Jiraissues add icon mapping configuration is susceptible to XSS

Collapse comment: Paul Curren added a comment - 29/May/2009 7:29 AM, Edited by Paul Curren - 29/May/2009 7:36 AM

Paul Curren added a comment - 29/May/2009 7:29 AM - edited

To fix this vulnerability in Confluence 2.10 please install version 2.8.13 of the JIRA plugin for Confluence.

This can be manually downloaded and installed from here. Alternatively you can upgrade via the plugin repository client embedded in Confluence.

Expand comment: Paul Curren added a comment - 29/May/2009 7:29 AM, Edited by Paul Curren - 29/May/2009 7:36 AM

Paul Curren added a comment - 29/May/2009 7:29 AM - edited To fix this vulnerability in Confluence 2.10 please install version 2.8.13 of the JIRA plugin for Confluence. This can be manually downloaded and installed from here . Alternatively you can upgrade via the plugin repository client embedded in Confluence.

Collapse comment: PdZ (Inactive) added a comment - 27/May/2009 4:51 AM

PdZ (Inactive) added a comment - 27/May/2009 4:51 AM

Confirmed that the original fix and subsequent fix for when a XSRF token is not supplied operate as expected.

Expand comment: PdZ (Inactive) added a comment - 27/May/2009 4:51 AM

PdZ (Inactive) added a comment - 27/May/2009 4:51 AM Confirmed that the original fix and subsequent fix for when a XSRF token is not supplied operate as expected.

Collapse comment: AudraA added a comment - 22/May/2009 5:03 AM

AudraA added a comment - 22/May/2009 5:03 AM

should be fixed in 3.0?? or at the latest 3.0.1

Expand comment: AudraA added a comment - 22/May/2009 5:03 AM

AudraA added a comment - 22/May/2009 5:03 AM should be fixed in 3.0?? or at the latest 3.0.1

Collapse comment: PdZ (Inactive) added a comment - 22/May/2009 4:05 AM

PdZ (Inactive) added a comment - 22/May/2009 4:05 AM

Bumped up to critical.

Expand comment: PdZ (Inactive) added a comment - 22/May/2009 4:05 AM

PdZ (Inactive) added a comment - 22/May/2009 4:05 AM Bumped up to critical.

Collapse comment: PdZ (Inactive) added a comment - 22/May/2009 4:05 AM

PdZ (Inactive) added a comment - 22/May/2009 4:05 AM

I'm going to have to reopen this one guys, and it is a bit more sinister than it was before.

When the XSRF token is not supplied, the literal text of the jiraEntityName & iconFilename are used as default form inputs. You can escape from the attribute that they are specified in quite trivially:

/admin/addiconmapping.action?jiraEntityName=%22%3EXSS%20goes%20here

So at the moment, the XSRF token (lack thereof) allows for an XSS attack:

Expand comment: PdZ (Inactive) added a comment - 22/May/2009 4:05 AM

PdZ (Inactive) added a comment - 22/May/2009 4:05 AM I'm going to have to reopen this one guys, and it is a bit more sinister than it was before. When the XSRF token is not supplied, the literal text of the jiraEntityName & iconFilename are used as default form inputs. You can escape from the attribute that they are specified in quite trivially: /admin/addiconmapping.action?jiraEntityName=%22%3EXSS%20goes%20here So at the moment, the XSRF token (lack thereof) allows for an XSS attack:

Collapse comment: Paul Curren added a comment - 21/May/2009 11:58 AM

Paul Curren added a comment - 21/May/2009 11:58 AM

Reviewed in http://developer.atlassian.com/jira/browse/CONFJIRA-152

Expand comment: Paul Curren added a comment - 21/May/2009 11:58 AM

Paul Curren added a comment - 21/May/2009 11:58 AM Reviewed in http://developer.atlassian.com/jira/browse/CONFJIRA-152

Collapse comment: Paul Curren added a comment - 20/May/2009 6:34 AM

Paul Curren added a comment - 20/May/2009 6:34 AM

Raised at http://developer.atlassian.com/jira/browse/CONFJIRA-152

Expand comment: Paul Curren added a comment - 20/May/2009 6:34 AM

Paul Curren added a comment - 20/May/2009 6:34 AM Raised at http://developer.atlassian.com/jira/browse/CONFJIRA-152

Collapse comment: Paul Curren added a comment - 20/May/2009 6:21 AM

Paul Curren added a comment - 20/May/2009 6:21 AM

You're right, although if you are a Confluence admin already (so able to access that action) there's quite a lot of evil you can do.

I'm lowering the priority since it relies on your confadmins not being trusted.

Expand comment: Paul Curren added a comment - 20/May/2009 6:21 AM

Paul Curren added a comment - 20/May/2009 6:21 AM You're right, although if you are a Confluence admin already (so able to access that action) there's quite a lot of evil you can do. I'm lowering the priority since it relies on your confadmins not being trusted.