Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-61888

XSS in /includes/decorators/global-translations.jsp

XMLWordPrintable

      NOTE: This bug report is for JIRA Server. Using JIRA Cloud? See the corresponding bug report.

      Somewhat hard to exploit but still doable when it comes to cache poisoning. Steps to reproduce:

      • Tamper with a GET request to http://<JIRA instance>/includes/decorators/global-translations.jsp with the Host header set to some XSS payload (e.g. 
        <script>alert(/xss/)</script>
      • The offending lines in code pick this payload and browser renders it (observe an alert with text "xss")

      Offending code in /src/main/webapp/includes/decorators/global-translations.jsp#18:

      17      <input type="hidden" title="ajaxUnauthorised" value="<ww:text name="'common.forms.ajax.unauthorised.alert'"/>">
18      <input type="hidden" title="baseURL" value="<%=request.getScheme() + "://" +request.getServerName() + ':' + request.getServerPort() + request.getContextPath()%>">
19      <input type="hidden" title="ajaxCommsError" value="<ww:text name="'common.forms.ajax.commserror'"/>">

        1. Selection_109.png
          Selection_109.png
          14 kB
        2. Selection_110.png
          Selection_110.png
          32 kB

            [JRASERVER-61888] XSS in /includes/decorators/global-translations.jsp

            David Black added a comment - - edited

            CVSS v3 score: 4.7 => Medium severity

            Exploitability Metrics

            Attack Vector Network
            Attack Complexity High
            Privileges Required None
            User Interaction Required

            Scope Metric

            Scope Changed

            Impact Metrics

            Confidentiality Low
            Integrity Low
            Availability None

            See http://go.atlassian.com/cvss for more details.

            David Black added a comment - - edited CVSS v3 score: 4.7 => Medium severity Exploitability Metrics Attack Vector Network Attack Complexity High Privileges Required None User Interaction Required Scope Metric Scope Changed Impact Metrics Confidentiality Low Integrity Low Availability None See http://go.atlassian.com/cvss for more details.

            Roberto dos Santos Soares added a comment -

            Hi guys!

            Any update on this vulnerability?

            Best regards,

            Roberto dos Santos Soares added a comment - Hi guys! Any update on this vulnerability? Best regards,

              apawelczyk Artur Pawelczyk (Inactive)
              3fcb179f0169 Roberto dos Santos Soares
              Affected customers:
              0 This affects my team
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: