Inbox for Jira Security Advisory 2021-10-28

Summary of vulnerability

This advisory discloses a critical severity security vulnerability in versions of the Inbox for Jira app prior to 5.0.4. 

Customers who have upgraded to Inbox for Jira version 5.0.4 aren't affected.

If you've downloaded and installed any versions listed in the Affected versions section, you must upgrade your installations to fix this vulnerability. 

Vulnerability 1: Stored XSS in the Rest API

Severity

Rixter AB rates the severity level of this vulnerability as critical, according to the scale published in  Atlassian severity levels. The scale allows us to rank the severity as critical, high, moderate, or low.

This is our assessment and you should evaluate its applicability to your own IT environment.

Description

The parameter phrase in the endpoint: /rest/inbox/1.0/notification/message/{user_name_to_notify} lacks user input validation leading to a stored Cross-Site Scripting attack.

Acknowledgments

The issue was discovered by michael.anastasakis@klarna.com of Klarna Bank AB via their internal security program.

Fix

We have taken the following steps to address this issue:

1. Released versions 5.0.4 of Inbox for Jira Data Center and Server

What you need to do

Rixter AB recommends that you upgrade to the latest fix version.

Upgrade

Click install in the Manage Apps section of your Jira instance or go to https://marketplace.atlassian.com/apps/1217318/inbox-in-app-notifications-for-jira?tab=overview&hosting=datacenter and download the app and install it manually

Support

If you have questions or concerns regarding this advisory, raise a support request at https://rixter.atlassian.net/servicedesk/customer/portal/2

References