CVE-2022-28650
📋 TL;DR
This vulnerability allows attackers to inject malicious JavaScript into Markdown content in JetBrains YouTrack's Classic UI. When exploited, it enables cross-site scripting (XSS) attacks that can steal user sessions, redirect users, or perform actions on their behalf. Organizations running YouTrack servers with the Classic UI enabled are affected.
💻 Affected Systems
- JetBrains YouTrack
📦 What is this software?
Youtrack by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, take over YouTrack instances, access sensitive issue tracking data, and pivot to internal systems.
Likely Case
Attackers inject malicious JavaScript to steal user session cookies, redirect users to phishing sites, or perform unauthorized actions within YouTrack.
If Mitigated
With proper input validation and output encoding, JavaScript execution would be prevented, limiting impact to benign Markdown rendering.
🎯 Exploit Status
Requires authenticated access to create or edit Markdown content. XSS exploitation techniques are well-documented and easily weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2022.1.43700 or later
Vendor Advisory: https://www.jetbrains.com/privacy-security/issues-fixed/
Restart Required: Yes
Instructions:
1. Backup YouTrack data and configuration. 2. Download YouTrack 2022.1.43700 or later from JetBrains website. 3. Stop YouTrack service. 4. Install/upgrade to patched version. 5. Restart YouTrack service. 6. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Disable YouTrack Classic UI
allSwitch to Modern UI only to avoid the vulnerable Classic UI component
Configure YouTrack to use Modern UI only via administration settings
Restrict Markdown Editing
allLimit Markdown editing permissions to trusted users only
Configure YouTrack permissions to restrict who can create/edit Markdown content
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to block inline JavaScript execution
- Enable input validation and output encoding for all user-generated Markdown content
🔍 How to Verify
Check if Vulnerable:
Check YouTrack version via Administration → General → About. If version is below 2022.1.43700, system is vulnerable.Check Version:
Check YouTrack web interface: Administration → General → About, or check server logs for version information.Verify Fix Applied:
After upgrade, verify version is 2022.1.43700 or higher and test Markdown fields for JavaScript injection attempts.📡 Detection & Monitoring
Log Indicators:
- Unusual Markdown content creation/editing patterns
- JavaScript code in Markdown fields in audit logs
- Multiple failed XSS attempts
Network Indicators:
- Unexpected JavaScript execution in YouTrack responses
- Suspicious content in POST requests to Markdown endpoints
SIEM Query:
source="youtrack" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=") AND event_type="content_edit"