HackerOne · Report #209917
javascript: and mailto: links are allowed in JIRA integration settings
Duplicatestatus
lowseverity
12upvotes
10 Apr 2017disclosed
How it was found
Summary: For new feature settings, you accept website URLs like javascript:// or data:// in base urls. Even https://evil.com works, this needs to be stripped, this can be used to create another integrations without
Steps To Reproduce
- https://hackerone.com/(Team)/integrations/jira/edit
- Try in Base URL: javascript:// or data://
- It will save and opens it everytime when escalate
Optional: Your Environment (Browser version, Device, etc)
Works in all browsers