Stored XSS in RTIR Ticket Creation Forms

Executive Summary

This vulnerability involves RTIR's ticket creation forms not properly escaping HTML in ticket subjects. When a ticket subject contains malicious scripts, it executes when a user opens the form to split a ticket or create an incident. Since unauthenticated users can create Incident Reports by default, an attacker can inject a script via the email report subject. The script then runs in the session of the incident handler who processes the report, allowing it to act with the handler's privileges in RT.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves malicious script execution in RTIR ticket forms due to unescaped ticket subjects. To detect it, inspect RTIR ticket creation forms for script tags in ticket subjects. Check server logs for unusual activity during ticket creation or splitting. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary scripts in the context of an incident handler's session. This could lead to unauthorized actions within RT, such as modifying tickets, accessing sensitive data, or performing privileged operations. The impact depends on the permissions of the affected user.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade RTIR to version 6.0.4 or later to patch the vulnerability. If using RTIR 5.0, no action is needed as it is not affected. Ensure ticket subjects are properly HTML-escaped in forms to prevent script execution.

Useful 0 Not Useful 0