Cross-Site Request Forgery exposure

[steve moffat]

Our security department has scanned our Jira (v7.4.2#74004-sha1:586975d) using an IBM tool called Appscan.  It reported a possible vulnerability.  I have to prepare a response to indicate if this is a known problem and when or if it will be fixed.  Any assistance would be appreciated.

Text from the report follows:

Cross-Site Request Forgery. It may be possible to steal or manipulate customer session and cookies, which might be used to impersonate a legitimate user, allowing the hacker to view or alter user records, and to perform transactions as that user. The test result seems to indicate a vulnerability because the test response is identical to the original response, indicating that the Cross Site Request Forgery attempt was successful, even though it included a fictive “Referer” header.

Recommendation: Validate the value of the "Referer" header, and use a one-time-nonce for each submitted form

[Matt Doar]

The security.atlassian.com page has a FAQ at https://www.atlassian.com/trust/faq

I found a vulnerability in one of your products, how do I report it? 

If you discovered a vulnerability in one of our products, we appreciate if you let us know so we can get it fixed ASAP.  Have a read through our instructions for how to report it and you could get some Atlassian swag or be added to our Hall of Fame.  

[Steve Moffat]

Thank you very much for the direction to report security issues.

Yes, this is what I needed!