Atlassian Jira // DOM XSS

Introduction

A DOM-based Cross-Site Scripting vulnerability affects Atlassian Jira 6.0.x through 6.1.4. It can be exploited without authentication by controlling the value of window.name before opening the Jira dashboard.

The vulnerable page reads the attacker-controlled value and inserts it into the DOM without proper output encoding. As a result, arbitrary JavaScript can execute within the Jira origin and with the privileges of the victim’s active session.

I initially discovered and confirmed the vulnerability on Tesla Motors’ Jira instance while participating in its bug bounty program.

VULNERABILITY DETAILS

Product: Atlassian Jira
Affected versions: 6.0.x through 6.1.4
Vulnerability: Unauthenticated DOM XSS
Date: January 27, 2016
Researcher: TinKode (Razvan Cernaianu)
Vendor: https://www.atlassian.com

VULNERABLE CODE

The attacker-controlled source is window.name. Its value is rendered inside the page without proper output encoding:

<div class="aui-page-header-main">
    <h1>${name}</h1>

</div>

When Jira loads /secure/Dashboard.jspa, the malicious window name reaches this sink and is interpreted as HTML instead of text.

PROOF OF CONCEPT

<html>

<script>

var victim = window.open('https://victim/secure/Dashboard.jspa','<script>alert(document.cookie);<\/script>');

</script>

</html>

The exploit opens the Jira dashboard in a new browsing context whose name contains the payload. If the victim is not authenticated, Jira first redirects them to the login page.

Because window.name persists across navigation and authentication, the payload remains available after the victim logs in and is redirected back to the dashboard. Jira then injects it into the DOM, causing the JavaScript to execute inside the newly authenticated session.

IMPACT

An attacker can send the malicious page to any Jira user, even one who is not currently authenticated. Once the victim logs in, the injected JavaScript can access information available to the active session, perform actions as the victim or extract data not protected by browser security controls.

The attack does not require the attacker to authenticate or know the victim’s session identifier.

Pages