Gantt-Chart For Jira 5.5.4 Cross Site Scripting Vulnerability

Product: Jira module "Gantt-Chart for Jira"
Manufacturer: Frank Polscheit - Solutions & IT-Consulting
Affected Version(s): <=5.5.4
Tested Version(s): 5.5.3, 5.5.4
Vulnerability Type: Cross-Site Scripting (CWE-79)
Risk Level: Medium
Solution Status: Fixed
Manufacturer Notification: 2020-07-23
Solution Date: 2020-07-31
Public Disclosure: 2020-08-03
CVE Reference: CVE-2020-15944
Author of Advisory: Sebastian Auwaerter, SySS GmbH
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Overview:
 
Gantt-Chart for Jira is a Jira module for displaying Gantt charts.
 
The manufacturer describes the product as follows (see [1]):
 
"High performance Gantt-Chart capable to display multi-projects with
10.000+ issues aggregating them as top-level big picture"
 
Due to missing validation of user input, the module is vulnerable to
a persistent cross-site scripting attack. As described in
security advisory SYSS-2020-029 (see [4]), it is also possible to
attack other users with this attack vector.
 
To exploit this vulnerability, an attacker has to be authenticated.
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Vulnerability Details:
 
The vulnerability exists because the names of newly created filters
are not properly sanitized by the extension. A simple attack vector
like "<script>alert('XSS')</script>" can be chosen as the name of
a filter and is then displayed on every load of the vulnerable module.
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Proof of Concept (PoC):
 
This security vulnerability can be reproduced by simply creating a new
filter with the "filter name" "<script>alert('XSS')</script>". Whenever
the dashboard with the vulnerable module is loaded, the attack vector
gets executed.
 
The following request is sent to the web server:
 
PUT /rest/gantt/1.0/user/properties/<chart_id>?userKey=<your_user_name>
HTTP/1.1
Host: <victim_host>
[...]
 
[...]"filters":{{"search":""},"<script>alert(\"XSS\")</script>"}[...]
 
!!! This filter can not be easily removed via the web interface. !!!
!!!                   Use with caution.                          !!!
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Solution:
 
Update to software version 5.5.5
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
#  0day.today [2020-08-12]  #