Uploaded image for project: 'Jira Software Data Center'
  1. Jira Software Data Center
  2. JSWSERVER-6705

XSS in redirectType parameter on SearchBoard.jspa

XMLWordPrintable

      NOTE: This bug report is for JIRA Software Server. Using JIRA Software Cloud? See the corresponding bug report.

      This is difficult to reproduce - needs tampering with the post data for the page.

      On Classic Board, go to the search box. Tamper with the posted data and add the parameter redirectURL with something like:
      redirectType=xxx"><img src=u onerror=alert(1)>
      (Note: it doesn't work if you use <script></script> tags)

      You need to have > 1 page of search results - more than 30 by default, or change the Issues Per Page in the Tools > User Preferences section.

      The image is rendered within the page numbers.

            [JSWSERVER-6705] XSS in redirectType parameter on SearchBoard.jspa

            Michael Tokar added a comment -

            QA-ed with Jo when she was developing the fix.

            Michael Tokar added a comment - QA-ed with Jo when she was developing the fix.

            ig (Inactive) added a comment -

            Code review?

            ig (Inactive) added a comment - Code review?

            David Black added a comment -

            CVSS score: 7.5 => High severity
             
            Exploitability Metrics

            AccessVector Network
            AccessComplexity Low
            Authentication None

             
            Impact Metrics

            ConfImpact Partial
            IntegImpact Partial
            AvailImpact Partial

            See https://extranet.atlassian.com/display/SECCOUNCIL/How+to+evaluate+vulnerability+severity+under+CVSS for details and http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2 for score calculator.

            David Black added a comment - CVSS score: 7.5 => High severity   Exploitability Metrics AccessVector Network AccessComplexity Low Authentication None   Impact Metrics ConfImpact Partial IntegImpact Partial AvailImpact Partial See https://extranet.atlassian.com/display/SECCOUNCIL/How+to+evaluate+vulnerability+severity+under+CVSS for details and http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2 for score calculator.

            JoanneA (Inactive) added a comment -

            Checked in on branch GHS-5562-XSS-bug, please test with GHS-5562.

            Changed from escapeJavaScript to htmlEncode - this ensures that all characters including ", <, > are encoded instead of just prefixed with \

            JoanneA (Inactive) added a comment - Checked in on branch GHS-5562 -XSS-bug, please test with GHS-5562 . Changed from escapeJavaScript to htmlEncode - this ensures that all characters including ", <, > are encoded instead of just prefixed with \

              Unassigned Unassigned
              jcranford@atlassian.com JoanneA (Inactive)
              Affected customers:
              0 This affects my team
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: