CVE-2010-1164

Vulnerability

Atlassian JIRA versions 3.12 through 4.1 contain multiple cross-site scripting (XSS) vulnerabilities in several pages. The Colour Picker page reflects user-supplied input via the element and defaultColor parameters without sanitization. The User Picker and Group Picker pages fail to encode the formName, element, and the full name or group name fields. Additional XSS vectors exist on groupnames.jsp, indexbrowser.jsp, classpath-debug.jsp, viewdocument.jsp, cleancommentspam.jsp, and on announcement preview, runportleterror.jsp, issuelinksmall.jsp, screenshot-redirecter.jsp, and the 500 error page via the HTTP Referrer header. These issues are documented in JRA-20994 and detailed in the Atlassian security advisory [1].

Exploitation

An attacker can send a crafted link or form submission to a victim who has access to a JIRA instance. The attacker does not need authentication or special privileges; any user who clicks the crafted URL or submits the malicious input will trigger the script execution in their browser session. For example, the afterURL parameter in screenshot-redirecter.jsp or the URI in issuelinksmall.jsp can be used to inject XSS payloads. The advisory notes that these vulnerabilities were exploited in the wild in April 2010 [1][4].

Impact

Successful exploitation allows a remote attacker to execute arbitrary web script or HTML in the context of the victim's browser session. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The impact is limited to the victim's interaction with JIRA; the attacker does not gain server-side privileges directly, but can leverage the XSS to perform actions as the victim user.

Mitigation

Atlassian released JIRA version 4.1.1 which contains fixes for these XSS vulnerabilities [1][2]. Users are strongly advised to upgrade to version 4.1.1 or later. No workarounds are described if an immediate upgrade is not possible. The advisory includes steps to determine if a system has been compromised, such as auditing logs for unusual activity [1].