DOM-based Cross Site Scripting Vulnerability- backbone-1.0.0.js

Question

We are using below versions of JIRA.

* Jira Server - 8.21
* Jira service management - 4.21.0
* Adaptavist ScriptRunner - 6.41.0
* JEMH -3.3.71
* JSU Automation Suite -2.32
* Atlassian Universal Plugin Manager - 5.1.2

And we are getting below vulnerable issue when we do the VA scan.  Anyone know how to solve this issue and which plugin has this js file?

siteurl/c277de0b4cdbabf116059d3b0bf2ca75-CDN/-h2lxxw/821000/1vdrktf/d2e244e05c844200cbfd78d4cbb94e58/_/download/contextbatch/js/_super/factories/backbone/1.0.0/backbone-1.0.0-factory.js)
* Line 33:Unsafe client output calling this.location.replace() with tainted arg

* Line 33:String concatenation with user-controlled value

* Line 33:"this.location.search" is controlled by the user

Alex.Aleksandrov · Answer

Hi @Janaki Lenagala, our scan reports the same vuln and I believe its caused by a plugin. Then I came across this blog. Were you able to remediate this?

Vishwas · Answer

Hey @Janaki Lenagala

can you just find out the exact path the file and paste it here, so that i can figure out from which plugin it is coming from. I would better suggest ask atlassian team on the ticket to tell what is this since they mentioned it was not native jira file rite?

Regards,

Vishwas

Janaki Lenagala · Answer

Hi Vishva,

That backbone-1.0.0 file is in the jslibs-3.0.0. jar file of JIRA.