17684f6fe1
5 changes to exploits/shellcodes Google Chrome 86.0.4240 V8 - Remote Code Execution Google Chrome 81.0.4044 V8 - Remote Code Execution Google Chrome 86.0.4240 V8 - Remote Code Execution Google Chrome 81.0.4044 V8 - Remote Code Execution Atlassian Jira Service Desk 4.9.1 - Unrestricted File Upload to XSS Composr CMS 10.0.36 - Cross Site Scripting Dell OpenManage Server Administrator 9.4.0.0 - Arbitrary File Read
24 lines
No EOL
1.2 KiB
Text
24 lines
No EOL
1.2 KiB
Text
# Exploit Title: Atlassian Jira Service Desk 4.9.1 - Unrestricted File Upload to XSS
|
|
# Date: 07 Mar 2020
|
|
# Exploit Author: Captain_hook
|
|
# Vendor Homepage: https://www.atlassian.com/
|
|
# Version: < 4.10.0
|
|
# Tested on: All OS
|
|
# CVE: CVE-2020-14166
|
|
|
|
Summary:
|
|
|
|
The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.
|
|
|
|
Steps to reproduce:
|
|
|
|
1- reach to this directory http://localhost:port/servicedesk/customer/portals?customize=true
|
|
2- There's a place where the banner can be uploaded when upload wizard popup you can see that the banner image restricted to image format, you can change that type easily
|
|
3- then you can upload HTML and javascript files and hijacking cookies or XSRF tokens.
|
|
|
|
Original report in bugcrowd:
|
|
|
|
https://bugcrowd.com/disclosures/61a50171-aa55-4126-b9f4-4e82b4b8c301/unrestricted-file-upload-stored-xss-for-token-hijacking
|
|
Original ticket in atlassian:
|
|
|
|
https://jira.atlassian.com/browse/JSDSERVER-6895?error=login_required&error_description=Login+required&state=28f8e754-fb05-4f5e-adda-79e252fe2c30 |