Uploaded image for project: 'Confluence Cloud'
  1. Confluence Cloud
  2. CONFCLOUD-29653

XSS vulnerability in Jira Macro *Existing*

    XMLWordPrintable

Details

    Description

      NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report.

      Xss exploit found when using the existing Confluence Jira Macro.

      Occurs when adding this url to the Macro's dialog and selecting the 'refresh' icon on the dialog also appears when saving and viewing the page after the page has been saved with the exploit. (see screenshot)

      http://kshekhar-pc:8080/sr/jira.issueviews:searchrequest-xml/temp/SearchRequest.xml?jqlQuery=&tempMax=1000

      To replicate:

      Setup Jira Instance with attach dataset
      On Confluence Instance setup an applinks with the Jira instance that has the dataset
      Copy the JQL url by going into the search issues and listing all issues in the 'XSS' project and select 'Export' -> 'XML'
      In Confluence Create a new Jira Issue Macro via the editor shortcut '{jira'
      Paste the above url
      Should get exploit upon selecting the refresh button on the dialog and also when saving the page

      Attachments

        1. demo.xml
          2 kB
        2. insert-page-1.png
          67 kB
        3. JIRA5.1_QAData.zip
          435 kB
        4. jiraissuemacro-xss.png
          98 kB
        5. page-home.png
          51 kB

        Issue Links

          Activity

            People

              hnguyen@atlassian.com Hai Nguyen (Inactive)
              gmartin Glenn Martin
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: