-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2018-037 Product: Pages for Bitbucket Server Manufacturer: Simplenia AG Affected Version(s): 2.6.0 and before Tested Version(s): 2.6.0 Vulnerability Type: Cross-Site Scripting (CWE-79) Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2018-11-26 Solution Date: 2018-12-19 Public Disclosure: 2019-01-31 CVE Reference: CVE-2018-19498 Author of Advisory: Simon Moser, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: Pages for Bitbucket Server is a plugin for Bitbucket Server to display HTML files in a repository. The manufacturer describes the product as follows (see [1]): "The Pages plugin allows you to publish static web pages in Bitbucket Server easily. Repository administrators can enable serving of static web pages for any existing branch or tag. Once enabled, users will be able to view HTML files of this branch or tag directly in Bitbucket." This design allows for cross-site scripting since its injected HTML code is provided at a subpath of the Bitbucket application. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: Published HTML files using the Pages plugin can contain JavaScript code. Therefore, it is, for instance, possible to access unprotected cookies or to execute actions on the web interface. This would not pose a threat if the executed code was contained on a subdomain or a different path (if Bitbucket himself already uses a subpath), since most cookies are restricted to their respective path. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): 1. Enable Pages for selected branch (Repository settings > Web Pages > Enabled) 2. Upload the following HTML file into this branch: * git clone @/scm// * cd * echo "

Cookies

" > index.html * git add index.html * git commit -m "XSS PoC" * git push 3. Visit https:///pages///browse/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: Update to the version 2.6.1 or higher of the plugin and disable JavaScript in custom pages ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2018-11-20: Vulnerability discovered 2018-11-26: Vulnerability reported to manufacturer 2018-12-19: Update released by manufacturer 2019-01-31: Advisory publicly released ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Product website for Pages for Bitbucket Server https://www.simplenia.com/bitbucket-plugins/pages [2] SySS Security Advisory SYSS-2018-037 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-037.txt [3] SySS Responsible Disclosure Policy https://www.syss.de/en/news/responsible-disclosure-policy/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Simon Moser of SySS GmbH. E-Mail: simon.moser@syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Simon_Moser.asc Key ID: 0x5FF2CFC6 Key Fingerprint: E3C2 A86E 530D 8BD3 C40B 6542 8376 5B89 5FF2 CFC6 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS Web site. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: https://creativecommons.org/licenses/by/3.0/deed.en -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEE48KoblMNi9PEC2VCg3ZbiV/yz8YFAlxO9M4ACgkQg3ZbiV/y z8b6EwgAjb83VSpSDV0txIs/BjKpZohU6jDDJBfmyv9lXxQIosY+1bi62k69iRC2 UIySI26wh9iwO4mC+86Iu0m/ZUmQ/fhtVPwd6tYWx30x/DxPOQAnTKHox4OL2a13 hw5IWlcki5C3UJKXagPQlr7aEu4mdjSezMopboafi7cPs8HF6PDLOdIA/Y6Hoa27 aPKZWq9j10N+0BsdTM0D2gV8zjgO2EY2mY/WCjj78O1eiRhvwyDz4eJKRI6FG+gS M3i7NZBN9VsZiJOyYdLOS/sq/eZbI39gXpUbJvSXsJlQFqOMMIICfgukycGv47Op jiT/zWoE7Qh3WmmXPfcF45PQ9zat3w== =BCXs -----END PGP SIGNATURE-----