HexBrain

HackerOne · Report #209917

javascript: and mailto: links are allowed in JIRA integration settings

Duplicatestatus
lowseverity
12upvotes
10 Apr 2017disclosed

How it was found

Summary: For new feature settings, you accept website URLs like javascript:// or data:// in base urls. Even https://evil.com works, this needs to be stripped, this can be used to create another integrations without

Steps To Reproduce

  1. https://hackerone.com/(Team)/integrations/jira/edit
  2. Try in Base URL: javascript:// or data://
  3. It will save and opens it everytime when escalate

Optional: Your Environment (Browser version, Device, etc)

Works in all browsers

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original