Atlassian Jira Service Desk 4.9.1 - Unrestricted File Upload to XSS

vendor:

Jira Service Desk

by:

Captain_hook

4.8

CVSS

MEDIUM

Cross Site Scripting (XSS)

CWE

Product Name: Jira Service Desk

Affected Version From: < 4.10.0

Affected Version To: < 4.10.0

Patch Exists: YES

Related CWE: CVE-2020-14166

CPE: a:atlassian:jira_service_desk

Metasploit: https://www.rapid7.com/db/vulnerabilities/atlassian-jira-cve-2020-14166/

Other Scripts: N/A

Platforms Tested: All OS

2020

Atlassian Jira Service Desk 4.9.1 – Unrestricted File Upload to XSS

The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.

Mitigation:

Upgrade to Jira Service Desk Server and Data Center version 4.10.0 or later.

Source

Exploit-DB raw data:

# Exploit Title: Atlassian Jira Service Desk 4.9.1 - Unrestricted File Upload to XSS
# Date: 07 Mar 2020
# Exploit Author: Captain_hook
# Vendor Homepage: https://www.atlassian.com/
# Version: < 4.10.0
# Tested on: All OS
# CVE: CVE-2020-14166

Summary:

The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.

Steps to reproduce:

1- reach to this directory http://localhost:port/servicedesk/customer/portals?customize=true
2- There's a place where the banner can be uploaded when upload wizard popup you can see that the banner image restricted to image format, you can change that type easily
3- then you can upload HTML and javascript files and hijacking cookies or XSRF tokens.

Original report in bugcrowd:

https://bugcrowd.com/disclosures/61a50171-aa55-4126-b9f4-4e82b4b8c301/unrestricted-file-upload-stored-xss-for-token-hijacking
Original ticket in atlassian:

https://jira.atlassian.com/browse/JSDSERVER-6895?error=login_required&error_description=Login+required&state=28f8e754-fb05-4f5e-adda-79e252fe2c30