Uploaded image for project: 'Jira Cloud'
  1. Jira Cloud
  2. JSWCLOUD-9069

ChartBoardAction.doSetCurveColor Persistent XSS

XMLWordPrintable

      The ChartBoardAction.doSetCurveColor method is vulnerable to persistent XSS when saving an unsanitized color parameter in user preferences. The set method isn’t protected from XSRF, allowing exploitation from remote attackers.

      File: greenhopper\src\main\java\com\pyxis\greenhopper\jira\Actions\ChartBoardAction.java

      ChartBoardAction.java
      package com.pyxis.greenhopper.jira.actions;
import java.io.IOException;
import java.util.Set;
...
@SuppressWarnings("serial")
public class ChartBoardAction extends VersionBoardAction
{
...
    protected String color;
...    
    public String doSetCurveColor()
    {
      Set<CurveSettings> settings = getChartContext().getSettings();
      for(CurveSettings curveSetting : settings)
      {
        if(curveSetting.getId().equals(curveId))
        {
          curveSetting.setColor(color);
          break;
        }
      }
      getPreferences().setSettings(getChartContext().getSettingsId(), settings);
      getPreferences().save();
      return SUCCESS;
    }
...
    public void setColor(String color)
    {
      this.color = color;
    }

        1. CurveColor XSS.PNG
          66 kB

            [JSWCLOUD-9069] ChartBoardAction.doSetCurveColor Persistent XSS

            Monique Khairuliana (Inactive) made changes -
            Workflow Original: JSWCLOUD Bug Workflow [ 3192799 ] New: JAC Bug Workflow v3 [ 3474122 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v6 - Restricted [ 1886731 ] New: JSWCLOUD Bug Workflow [ 3192799 ]
            vkharisma made changes -
            Project Import New: Sun Apr 02 01:01:23 UTC 2017 [ 1491094883663 ]
            Owen made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v6 [ 908803 ] New: JIRA Bug Workflow w Kanban v6 - Restricted [ 1551254 ]
            Security Metrics Bot made changes -
            Labels Original: fixme security security_codereview New: cvss-high fixme security security_codereview
            Oswaldo Hernandez (Inactive) made changes -
            Workflow Original: GreenHopper Kanban Workflow 20141014 [ 747025 ] New: JIRA Bug Workflow w Kanban v6 [ 908803 ]
            David Black made changes -
            Remote Link Original: This issue links to "Page (Extranet)" [ 53548 ] New: This issue links to "Page (Extranet)" [ 53548 ]
            Craig Davies (Inactive) made changes -
            Remote Link Original: This issue links to "Page (Extranet)" [ 53548 ] New: This issue links to "Page (Extranet)" [ 53548 ]
            Ashley Blackmore made changes -
            Remote Link Original: This issue links to "Page (Extranet)" [ 53548 ] New: This issue links to "Page (Extranet)" [ 53548 ]
            Ashley Blackmore made changes -
            Remote Link Original: This issue links to "Page (Extranet)" [ 53548 ] New: This issue links to "Page (Extranet)" [ 53548 ]

              Unassigned Unassigned
              cee3f48a9671 Daniel
              Affected customers:
              0 This affects my team
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: