Headline
GHSA-wc53-4255-gw3f: The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server
Impact
If the JIRA macro is installed, any logged in XWiki user could edit his/her user profile wiki page and use that JIRA macro, specifying a fake JIRA URL that returns an XML specifying a DOCTYPE pointing to a local file on the XWiki server host and displaying that file’s content in one of the returned JIRA fields (such as the summary or description for example).
For example:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<rss version="0.92">
...
<item>
<title>&xxe;</title>
<link>https://jira.xwiki.org/browse/XE-307</link>
<project id="10222" key="XE">{RETIRED} XWiki Enterprise</project>
<description>&xxe;</description>
<environment/>
...
Patches
The vulnerability has been patched in the JIRA Extension v8.6.5.
Workarounds
No easy workaround except to upgrade (which is easy using the XWiki Extension Manager).
References
- https://github.com/xwiki-contrib/jira/commit/98a74c2a516b42689c73b13ecd94e9c1998fa9cb and https://github.com/xwiki-contrib/jira/commit/5049e352d16f8356734de70daf1202301f170ee6
- https://jira.xwiki.org/browse/JIRA-49
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki.org
- Email us at Security Mailing List
Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.