After running an Alienvault USM scan against Jira, it found a medium vulnerability:
Port 443 'Vulnerability Detection Result: The cookies: Set-Cookie: atlassian.xsrf.token=xxxxxxxxxxxxxxxxxxxxx|lout; Path=/ are missing the "httpOnly" attribute. Insight: The flaw is due to a cookie is not using the 'httpOnly' attribute.'
Looking at the network packets I can see that there are two cookies:
JSESSIONID has two attributes - 'secure: true' & 'httpOnly: true'
atlassian.xsrf.token has only one attribute - 'secure: true'
Is there a way to set the 'httpOnly: true' attribute on the atlassian.xsrf.token cookie.
Thanks in advance.
This has been addressed by our Atlassian security team, this attribute has been assessed and determined that making the http only would not improve security as an attacker who can XSS a Jira user can already obtain their csrf/xsrf token by making an Ajax request to a Jira page as the xsrf/csrf token is found in the meta information page.
The atlassian.xsrf.token does not require this flag as it's not an authentication cookie. An attacker in possession of that cookie would not be able to access Jira without the JSESSIONID one.
Basically, as long as you have the attribute useHTTPOnly set to true in your $JIRA-installation-directory/server.xml Tomcat config file:
<Context path="" docBase="${catalina.home}/atlassian-jira" reloadable="false" useHttpOnly="true">
The cookie JSESSIONID and other authentication cookies would be protected by the httponly flag. However, the reason why the atlassian.xsrf.token cookie doesn't require this flag, is because that cookie by itself cannot be used by an attacker to exploit JIRA authentication.
Hello @Mahtab
please suggest this type of threats "Session Cookie path attribute not set" Is there any possible please answer me TQ
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Session Cookie path attribute not set
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Modifying tomcat configuration still kind of works, but you have to find out the version of Tomcat first. Open RELEASE-NOTE in tomcat-docs to see the version of tomcat, and then you can follow [this](https://geekflare.com/secure-cookie-flag-in-tomcat/) to set up httpOnly attribute.
The problem I am running into is that JIRA (version 7.8.1) can't log me in once httpOnly is set for atlassian.xsrf.token. Seems like JIRA set that cookie by javascript.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
We suffer the same issue - Openvas claims with 5.0 (MEDIUM) security score.
Atlassian - will you please fix this?
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Having the same issue in Jira (7.11.0, build 711000).
Tryed the solution mentioned below from Ceiba Software but that doesn´t work.
Also I´m not sure if I applied it correct. Changed context.xml from:
<Context>
<!-- Default set of monitored resources. If one of these changes, the -->
<!-- web application will be reloaded. -->
<WatchedResource>WEB-INF/web.xml</WatchedResource>
<WatchedResource>${catalina.base}/conf/web.xml</WatchedResource>
<!-- Uncomment this to disable session persistence across Tomcat restarts -->
<!--
<Manager pathname="" />
-->
</Context>
to:
<Context useHttpOnly="true">
<Manager/>
<!-- Default set of monitored resources. If one of these changes, the -->
<!-- web application will be reloaded. -->
<WatchedResource>WEB-INF/web.xml</WatchedResource>
<WatchedResource>${catalina.base}/conf/web.xml</WatchedResource>
<!-- Uncomment this to disable session persistence across Tomcat restarts -->
<!--
<Manager pathname="" />
-->
</Context>
Also tried to add
<http-only>true</http-only>
<secure>true</secure>
into the <session-config> of atlassian-jira/WEB-INF/web.xml
of course i restarted jira after the changes...
Can anyone help me with this?
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
i found :
this is related to : https://confluence.atlassian.com/jira064/jira-security-advisory-2010-06-18-720415809.html
Open the context.xml
file of the Tomcat installation running JIRA in a text editor.
Add the following Manager
element within the Context
element of this file:
...
<Context useHttpOnly="true">
...
<Manager/>
...
</Context>
...
To disable HttpOnly Session ID cookies, change the value of the
useHttpOnly
parameter to false
.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
the original question was about the xsrf token, not the session ID
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.