Atlassian JIRA v6.0.3 Arbitrary HTML/Script Execution Vulnerability

2013-08-0600:00:00

Gjoko Krstic

zeroscience.mk

114

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

6.2

Confidence

High

EPSS

0.004

Percentile

72.2%

JSON

Title: Atlassian JIRA v6.0.3 Arbitrary HTML/Script Execution Vulnerability
Advisory ID: ZSL-2013-5151
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 06.08.2013

Summary

JIRA is an issue tracking project management software for teams planning, building, and launching great products.

Description

JIRA suffers from a reflected XSS issue due to a failure to properly sanitize user-supplied input to the ‘name’ GET parameter in the ‘deleteuserconfirm.jsp’ script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user’s browser session.

Vendor

Atlassian Corporation Pty Ltd. - <https://www.atlassian.com>

Affected Version

6.0.3 and 6.0.2

Tested On

Microsoft Windows 7 Ultimate SP1 (EN)

Vendor Status

[25.06.2013] Vulnerability discovered.
[26.06.2013] Contact with the vendor.
[26.06.2013] Vendor replies asking more details.
[26.06.2013] Sent details to the vendor.
[27.06.2013] Vendor confirms the vulnerability.
[28.06.2013] Working with the vendor.
[05.08.2013] Vendor releases versions 6.0.5 and 6.1-OD-04 to address this issue.
[06.08.2013] Coordinated public security advisory released.

PoC

jira_xss.txt

Credits

Vulnerability discovered by Gjoko Krstic - <[email protected]>

References

[1] <https://jira.atlassian.com/browse/JRA-34160>
[2] <https://jira.atlassian.com/browse/JRA/fixforversion/33790>
[3] <https://jira.atlassian.com/browse/JRA/fixforversion/34310>
[4] <http://packetstormsecurity.com/files/122721>
[5] <http://cxsecurity.com/issue/WLB-2013080065>
[6] <http://secunia.com/advisories/54417/>
[7] <http://www.securityfocus.com/bid/61647>
[8] <http://xforce.iss.net/xforce/xfdb/86311>
[9] <http://www.osvdb.org/show/osvdb/96070>
[10] <http://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-5319>
[11] <http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5319>

Changelog

[06.08.2013] - Initial release
[07.08.2013] - Added reference [4], [5], [6] and [7]
[09.08.2013] - Added reference [8]
[11.08.2013] - Added reference [9]
[22.08.2013] - Added reference [10] and [11]

Contact

Zero Science Lab

Web: <http://www.zeroscience.mk>
e-mail: [email protected]

<html><body><p>Atlassian JIRA v6.0.3 Arbitrary HTML/Script Execution Vulnerability


Vendor: Atlassian Corporation Pty Ltd.
Product web page: https://www.atlassian.com
Affected version: 6.0.3 and 6.0.2

Summary: JIRA is an issue tracking project management software
for teams planning, building, and launching great products.

Desc: JIRA suffers from a reflected XSS issue due to a failure
to properly sanitize user-supplied input to the 'name' GET parameter
in the 'deleteuserconfirm.jsp' script. Attackers can exploit this
weakness to execute arbitrary HTML and script code in a user's browser
session.

Vulnerable JSP script location:
- jira-components/jira-webapp/src/main/webapp/secure/admin/user/views/deleteuserconfirm.jsp


Tested on: Microsoft Windows 7 Ultimate SP1 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2013-5151
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5151.php

Vendor: https://jira.atlassian.com/browse/JRA-34160
        https://jira.atlassian.com/browse/JRA/fixforversion/33790
        https://jira.atlassian.com/browse/JRA/fixforversion/34310



25.06.2013

--


 http://localhost:8080/secure/admin/user/DeleteUser!default.jspa?name=a"&gt;<script>alert(document.cookie);</script>&amp;returnUrl=UserBrowser.jspa
</p></body></html>