Unauthorized Issue Description Modification via External Share Plugin for JIRA

Description

BugCrowd: c745a0c4-fd33-4721-9a7e-ada882ae4928
Ecosystem: AMS-25633


A vulnerability was identified that allows unauthorized modifications to the descriptions of private issues via the External Share for JIRA plugin. This exploit can be carried out through an external share of any issue accessible to a lower-privileged user.

Activity

Automation for Jira 26 October 2023, 17:39

Hello @Michał Szkrabko,

Please merge code to dev branch.
This is the best moment to add more information that can be helpful to prepare release notes.

  • Can you prepare short overview of change that can be used in release notes?

  • Please provide short GIF that showcase feature.

  • If GIF make no sense, can you provide image that highlights feature that can be used in release notes (cropped & annotated)?

Parsa Shiva 26 October 2023, 17:39

@Michał Szkrabko Fix verified - QA environment.

Update endpoint does not include IssueKey parameter any longer.

Michał Szkrabko 26 October 2023, 15:37

@Parsa Shiva issueKey was passed from frontend instead of being taken from share context on backend - I have removed this from endpoint method (as a test, one can look in the request payload and see that it os no longer sent). Simple regression test would also be appreciated, to confirm that edition of summary/description works fine when it should.

I am aware that error handling is not working (ie: turn on summary edit → open issue in another tab → turn off summary edit → try to edit summary on previously loaded share: edition will not succeed, but no error will be displayed, other than the one in developer console), but this is not in the scope of this bug.

Automation for Jira 26 October 2023, 15:27

Hello @Michał Szkrabko ]

This is the best moment to add more information that can be helpful for tester.

  • What areas are affected?

  • What are potential edge cases?

  • Was it checked for XSS problems?

  • Does change affect security, is new data exposed?

Please attach - Before / After screenshot if possible.

Automation for Jira 26 October 2023, 15:23

Hello @Kamil Zarychta,
Task is ready for review.

@Michał Szkrabko please make sure reviewer
have easy access to contend to be reviewed.

If this is code change. Please make sure PR is created.
If this is new documentation, blogpost, etc. Please provide link to page.