Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-55918

XSS in User Macros, Macro Title and Icon URL

XMLWordPrintable

      Summary

      System Administrator is allowed to input JS/CSS in Macro Title and Icon URL in Macro Editor. The script input in the fields can be executed when user open "Macro" selection window.

      How to reproduce

      1. Go to "Edit User Macro"  as Confluence Administrator.
      2. Input "'"><img src=x onerror=alert(1)>" in Macro Title field.
      3. Input "http'"><img src=x onerror=alert(3)>" in Icon URL field.
      4. Click save.
      5. Go to a certain page to edit.
      6. In edit UI, Select "+" then select "... Other Macros".
      7. Popups appear as alert(1) and alert(3) as set.

      Expected

      • JS/CSS should not be allowed in Macro Title and Icon URL.

       

        1. Screen Shot 2018-06-14 at 17.27.45.png
          531 kB
          Yumi Nakajima
        2. Screen Shot 2018-06-14 at 17.31.31.png
          762 kB
          Yumi Nakajima

            [CONFSERVER-55918] XSS in User Macros, Macro Title and Icon URL

            Katherine Yabut made changes -
            Workflow Original: JAC Bug Workflow v3 [ 2883182 ] New: CONFSERVER Bug Workflow v4 [ 3005522 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow v2 [ 2791331 ] New: JAC Bug Workflow v3 [ 2883182 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Xinyi Xu (Inactive) made changes -
            Resolution New: Fixed [ 1 ]
            Status Original: Waiting for Release [ 12075 ] New: Resolved [ 5 ]
            Xinyi Xu (Inactive) made changes -
            Fix Version/s New: 6.10.1 [ 80901 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow [ 2718438 ] New: JAC Bug Workflow v2 [ 2791331 ]
            Owen made changes -
            Symptom Severity Original: Minor [ 14432 ] New: Severity 3 - Minor [ 15832 ]
            Alex Yakovlev (Inactive) made changes -
            Labels Original: lbp lbp-bugfix no-cvss-required platform-bugfix security New: lbp lbp-bugfix no-cvss-required security
            Alex Yakovlev (Inactive) made changes -
            Labels Original: lbp no-cvss-required platform-bugfix security New: lbp lbp-bugfix no-cvss-required platform-bugfix security
            Alex Yakovlev (Inactive) made changes -
            Labels Original: lbp no-cvss-required platform platform-bugfix security New: lbp no-cvss-required platform-bugfix security
            Alex Yakovlev (Inactive) made changes -
            Labels Original: no-cvss-required platform platform-bugfix security New: lbp no-cvss-required platform platform-bugfix security

              xxu@atlassian.com Xinyi Xu (Inactive)
              d76fbf37b9ef 西谷完太
              Affected customers:
              1 This affects my team
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: