# Changing Victim's JIRA Integration Settings Through Multiple Bugs

Chained JIRA OAuth CSRF, consent-screen info gap, and open-redirect let an attacker relink a victim program's JIRA integration to the attacker's project, cloning new reports.

- Payout: $1,000
- Severity: medium
- Program: HackerOne
- Credited: whhackersbr
- Disclosed: 2017-05-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/226199
- Library page: https://bugbountylibrary.com/r/h1%3A226199
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:oauth tech:saml technique:chained vuln:business-logic vuln:csrf vuln:open-redirect

**Target:** JIRA integration / OAuth linking flow
**Root cause:** JIRA OAuth link flow lacked CSRF protection and the consent screen did not disclose which JIRA project would be connected, so a crafted link auto-selected the attacker's project.
**Steps:**
1. Attacker prepares a malicious JIRA JWT/OAuth link pointing to attacker's JIRA project
2. Attacker wraps link via HackerOne SAML open redirect and link-protection bypass (`/users/%2E/saml/sign_in?email=...`)
3. Send link to victim who has JIRA already connected to their program
4. Victim clicks `Link JIRA Instance to program`; OAuth CSRF completes without interaction
5. Attacker's JIRA project is auto-selected and linked to victim's program
**How found:** Researcher noticed the consent screen did not reveal the target JIRA project, then tested whether a pre-crafted JWT link would auto-select a project, and combined with known open-redirect/CSRF weaknesses to bypass protections.
**Exploitation:** Attacker delivers a crafted link through the SAML open redirect to bypass link protection; victim clicking the link triggers the JIRA OAuth flow (no CSRF token) which silently relinks the program's JIRA integration to the attacker's project, so all new HackerOne reports are cloned to attacker-controlled JIRA.
**Escalation:** Chained four separate issues (consent info gap, auto project selection, link-protection bypass, SAML open redirect, OAuth CSRF) to achieve silent relink.
**Insight:** On OAuth integration flows, check whether the consent screen discloses the destination resource (project/tenant) and whether the callback/state is CSRF-protected; a missing state plus auto-selection lets a crafted link silently rebind integrations.