Unauthorized Issue Description Modification via External Share Plugin for JIRA
Description
BugCrowd: c745a0c4-fd33-4721-9a7e-ada882ae4928
Ecosystem: AMS-25633
A vulnerability was identified that allows unauthorized modifications to the descriptions of private issues via the External Share for JIRA plugin. This exploit can be carried out through an external share of any issue accessible to a lower-privileged user.
Activity
Show:
Create issue
Released
Add watchers
Details
Priority
Created
26 October 2023, 17:15
Updated
15 November 2024, 15:54
Created: 26 October 2023, 15:15
Updated:
15 November 2024, 14:54
Hello @Michał Szkrabko,
Please merge code to dev branch.
This is the best moment to add more information that can be helpful to prepare release notes.
Can you prepare short overview of change that can be used in release notes?
Please provide short GIF that showcase feature.
If GIF make no sense, can you provide image that highlights feature that can be used in release notes (cropped & annotated)?
@Michał Szkrabko Fix verified - QA environment.
Update endpoint does not include IssueKey parameter any longer.
@Parsa Shiva issueKey was passed from frontend instead of being taken from share context on backend - I have removed this from endpoint method (as a test, one can look in the request payload and see that it os no longer sent). Simple regression test would also be appreciated, to confirm that edition of summary/description works fine when it should.
I am aware that error handling is not working (ie: turn on summary edit → open issue in another tab → turn off summary edit → try to edit summary on previously loaded share: edition will not succeed, but no error will be displayed, other than the one in developer console), but this is not in the scope of this bug.
Hello @Michał Szkrabko ]
This is the best moment to add more information that can be helpful for tester.
What areas are affected?
What are potential edge cases?
Was it checked for XSS problems?
Does change affect security, is new data exposed?
Please attach - Before / After screenshot if possible.
Hello @Kamil Zarychta,
Task is ready for review.
@Michał Szkrabko please make sure reviewer
have easy access to contend to be reviewed.
If this is code change. Please make sure PR is created.
If this is new documentation, blogpost, etc. Please provide link to page.