Insecure display of HTML messages in search results

We recently discovered that if a user opens an email from our JIRA instance in the WebUI, all links are changed to start with the JIRA url, not with the archive url.

Upon further investigation I found that when the content of the preview pane is loaded, the HTML is embedded in the current page. For our JIRA mails the response of the AJAX call to message.php looks like:

<div id="restorebox" class="alert alert-general">
</div>

<div class="messageheader">
...
</div>

<div id="notesbox" class="input-prepend input-append">
...
</div>


<div id="messageblock">

<div class="messageheader">
...
</div>
<div class="messagecontents">

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
    <head> 
        <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> 
        <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0"> 
        <base href="https://jira.example.com"> 
        <title>Message Title</title> 
    </head> 
    <body> 
....
    </body>
</html>

</div>

</div>

For one: I'm pretty sure that the nodes DOCTYPE, html, head and body are allowed only once per page.

What causes the real trouble is the <base node: this sets the new base URL for all relative links.

Furthermore I think that the HTML content of a mail isn't properly sanitized and a specially crafted mail could lead to a XSS vulnerability. At the very least it's possible to hijack the current session.

Comments (8)