Jira 4.0.1 Cross Site Scripting

` Jira - Multiple Low Risk Vulnerabilities  
  
  
Versions Affected: 4.0.1 (other versions were not checked.)  
  
Info:  
JIRA provides issue tracking and project tracking for software  
development teams to improve code quality and the speed of  
development. (and so forth.)  
  
External Links:  
http://www.atlassian.com/software/jira/  
  
Credits: MaXe (no previous vulnerability information about these  
bugs were found.)  
  
  
-:: The Advisory ::-  
Jira is prone to Cross Site Script Redirection (XSSR) also known as  
Cross Site Redirection (CSR), Non-Persistent Script Injection and  
Low Risk Information Disclosure.  
  
Cross Site Script Redirection:  
The "returnUrl" GET-request within ViewIssue.jspa is not sanitizing  
user-input in a sufficient way allowing the Data URI scheme to be  
used in an attack.  
  
Proof of Concept URL:  
ViewIssue.jspa?id=[VALID_ID]&watch=true&returnUrl=data:text/html,<script>alert(0)</script>  
  
  
Non-Persistent Script Injection:  
The "returnUrl" GET-request within default.jspa is not sanitizing  
user-input in a sufficient way allowing the javascript URI scheme  
to be used in a conditional attack if the target user clicks the "Cancel"  
button on the target site which is affected by this vulnerability.  
  
Proof of Concept URL:  
AttachFile!default.jspa?id=[VALID_ID]&returnUrl=javascript:alert(0)';foo='  
  
  
Low Risk Information Disclosure:  
The "reportKey" GET-request within ConfigureReport.jspa is not  
sanitized properly for erroneous input and may cause an exception  
when a value passed to this function is invalid.  
  
This will disclose information such as:  
- Kernel information  
- MySQL version  
- Plugins enabled  
- Architecture  
- Username the application is running under.  
- Java Version  
- And more..  
  
Proof of Concept URL:  
ConfigureReport.jspa?selectedProjectId=[VALID_ID]&reportKey='invalid&Next=Next  
  
-:: Solution ::-  
There is currently no known solution at the moment. Jira is closed  
source and it is therefore not possible to provide a patch nor audit  
the code in order to find any further vulnerabilities easily.  
  
  
Disclosure Information:  
- Vulnerabilities found and researched: 23rd July 2010  
- Vulnerabilities disclosed at InterN0T 24th July  
- Bugtraq contacted (again) at: 28th July  
  
  
References:  
http://forum.intern0t.net/intern0t-advisories/2861-jira-enterprise-4-0-1-multiple-low-risk-vulnerabilities.html  
  
  
All of the best,  
MaXe  
`