{"action":"closed","issue":{"url":"https://api.github.com/repos/mailru/jira-plugins-mailrucal/issues/61","repository_url":"https://api.github.com/repos/mailru/jira-plugins-mailrucal","labels_url":"https://api.github.com/repos/mailru/jira-plugins-mailrucal/issues/61/labels{/name}","comments_url":"https://api.github.com/repos/mailru/jira-plugins-mailrucal/issues/61/comments","events_url":"https://api.github.com/repos/mailru/jira-plugins-mailrucal/issues/61/events","html_url":"https://github.com/mailru/jira-plugins-mailrucal/issues/61","id":154720086,"number":61,"title":"Stored Cross Site Scripting in Mail.ru Calendar JIRA Plugin","user":{"login":"opjoshi","id":19347748,"avatar_url":"https://avatars.githubusercontent.com/u/19347748?v=3","gravatar_id":"","url":"https://api.github.com/users/opjoshi","html_url":"https://github.com/opjoshi","followers_url":"https://api.github.com/users/opjoshi/followers","following_url":"https://api.github.com/users/opjoshi/following{/other_user}","gists_url":"https://api.github.com/users/opjoshi/gists{/gist_id}","starred_url":"https://api.github.com/users/opjoshi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/opjoshi/subscriptions","organizations_url":"https://api.github.com/users/opjoshi/orgs","repos_url":"https://api.github.com/users/opjoshi/repos","events_url":"https://api.github.com/users/opjoshi/events{/privacy}","received_events_url":"https://api.github.com/users/opjoshi/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mailru/jira-plugins-mailrucal/labels/bug","name":"bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-05-13T14:08:05Z","updated_at":"2016-07-04T08:02:37Z","closed_at":"2016-07-04T08:02:37Z","body":"Dear Team,\r\nI have identified Stored Cross Site Scripting Vulnerability in the Mail.ru Calendar plugin of JIRA .I was testing JIRA v.6.4 and Mail.ru Calendar plugin deployed is 2.4.2.50_JIRA6.\r\n\r\nI have already reported to Atlassian Website and they have confirmed this vulnerability and told me that will contact vendor.\r\nAtlassian Service Security Desk Reference ID: SEC-755\r\n\r\nJIRA Version: v 6.4\r\nPlatform: Windows 7 (64 Bit)\r\nMail.ru Calendar Version: 2.4.2.50_JIRA6\r\n\r\n![jira_create_calender_stored_xss_executed](https://cloud.githubusercontent.com/assets/19347748/15250311/d3a3af0a-1941-11e6-8669-82abe2572ff8.png)\r\n![jira_create_calender_stored_xss_payload](https://cloud.githubusercontent.com/assets/19347748/15250312/d3a608cc-1941-11e6-98de-bc7cf1b05b77.png)\r\n\r\nAffected URL:- https://mtjira.searshc.com/jira/secure/MailRuCalendar.jspa#period/month\r\n\r\nAttack Scenario:\r\nStep 1. Login into JIRA v6.4\r\nStep 2: Go to Calender.\r\nStep 3: Click on Add Calender tab -> Create New\r\nStep 4: Insert XSS payload in \"Name\" parameter of Create Calender. I have used \"><img src=x onerror=prompt(document.cookie);> XSS payload\r\nStep 5: Then click on Create\r\nStep 6: Whenever anyone try to edit the alert XSS Script will get execute.\r\n\r\nImpact of attack: An attack can perform Cross Site Scripting attack and steal the cookie of other active sessions.An attacker would exploit a vulnerability within a website or web\r\napplication that the victim would visit, essentially using the vulnerable website as a vehicle to deliver a malicious script to the victim’s browser. An attacker might be able to put stored XSS into the website. https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)\r\n\r\nRecommendation:\r\nUse an appropriate combination of white listing and blacklisting to\r\nensure only valid and expected input is processed by the system.Furthermore,\r\nclasses within the output tag libraries should also be modified to encode potentially dangerous characters with their HTML escape Counter parts.\r\nFor more information refer the following link https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet"}}
{"actor":{"display_login":"mashintsev"}}