CVE-2024-50575
📋 TL;DR
This vulnerability allows reflected cross-site scripting (XSS) attacks in JetBrains YouTrack's Widget API. Attackers can inject malicious scripts that execute in users' browsers when they click specially crafted links. All YouTrack instances running vulnerable versions are affected.
💻 Affected Systems
- JetBrains YouTrack
📦 What is this software?
Youtrack by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, or redirect users to malicious sites, potentially leading to account compromise or data theft.
Likely Case
Attackers could perform limited session hijacking or defacement through malicious script execution in users' browsers.
If Mitigated
With proper input validation and output encoding, the impact is minimal as malicious scripts would be neutralized before execution.
🎯 Exploit Status
Reflected XSS typically requires user interaction (clicking a malicious link) but is straightforward to exploit once the vulnerability is understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.3.47707
Vendor Advisory: https://www.jetbrains.com/privacy-security/issues-fixed/
Restart Required: Yes
Instructions:
1. Backup your YouTrack instance. 2. Download version 2024.3.47707 or later from JetBrains. 3. Follow JetBrains' upgrade documentation for your deployment type. 4. Restart the YouTrack service.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall (WAF) rules or reverse proxy filters to sanitize Widget API inputs
Content Security Policy
allImplement strict CSP headers to limit script execution sources
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to prevent inline script execution
- Configure WAF rules to block suspicious patterns in Widget API requests
🔍 How to Verify
Check if Vulnerable:
Check YouTrack version in Administration → System → About. If version is below 2024.3.47707, you are vulnerable.Check Version:
Check web interface at Administration → System → About or review server logs for version informationVerify Fix Applied:
After upgrade, verify version is 2024.3.47707 or higher in Administration → System → About.📡 Detection & Monitoring
Log Indicators:
- Unusual Widget API requests with script tags or JavaScript payloads
- Multiple failed Widget API requests with similar patterns
Network Indicators:
- HTTP requests to Widget API endpoints containing script tags or JavaScript code
- Referrer headers containing malicious payloads
SIEM Query:
source="youtrack" AND (uri="*/api/widget*" AND (content="<script" OR content="javascript:"))