Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-29653

XSS vulnerability in Jira Macro *Existing*

    XMLWordPrintable

Details

    Description

      NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report.

      Xss exploit found when using the existing Confluence Jira Macro.

      Occurs when adding this url to the Macro's dialog and selecting the 'refresh' icon on the dialog also appears when saving and viewing the page after the page has been saved with the exploit. (see screenshot)

      http://kshekhar-pc:8080/sr/jira.issueviews:searchrequest-xml/temp/SearchRequest.xml?jqlQuery=&tempMax=1000

      To replicate:

      Setup Jira Instance with attach dataset
      On Confluence Instance setup an applinks with the Jira instance that has the dataset
      Copy the JQL url by going into the search issues and listing all issues in the 'XSS' project and select 'Export' -> 'XML'
      In Confluence Create a new Jira Issue Macro via the editor shortcut '{jira'
      Paste the above url
      Should get exploit upon selecting the refresh button on the dialog and also when saving the page

      Attachments

        1. demo.xml
          2 kB
        2. insert-page-1.png
          insert-page-1.png
          67 kB
        3. JIRA5.1_QAData.zip
          435 kB
        4. jiraissuemacro-xss.png
          jiraissuemacro-xss.png
          98 kB
        5. page-home.png
          page-home.png
          51 kB

        Issue Links

          Activity

            People

              hnguyen@atlassian.com Hai Nguyen (Inactive)
              gmartin Glenn Martin
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: