DOM-based Cross Site Scripting Vulnerability- backbone-1.0.0.js

[Janaki Lenagala]

We are using below versions of JIRA. 

1. Jira Server - 8.21
2. Jira service management - 4.21.0
3. Adaptavist ScriptRunner - 6.41.0
4. JEMH -3.3.71
5. JSU Automation Suite -2.32
6. Atlassian Universal Plugin Manager - 5.1.2

And we are getting below vulnerable issue when we do the VA scan.  Anyone know how to solve this issue and which plugin has this js file?

siteurl/c277de0b4cdbabf116059d3b0bf2ca75-CDN/-h2lxxw/821000/1vdrktf/d2e244e05c844200cbfd78d4cbb94e58/_/download/contextbatch/js/_super/factories/backbone/1.0.0/backbone-1.0.0-factory.js)
* Line 33:Unsafe client output calling this.location.replace() with tainted arg

* Line 33:String concatenation with user-controlled value

* Line 33:String concatenation with user-controlled value

* Line 33:String concatenation with user-controlled value

* Line 33:"this.location.search" is controlled by the user

[Vishwas]

Hey @Janaki Lenagala 

Are you using any external tool to do this VA Scan ? 

If there is any vulnerabilities found the best way to check this up is get in direct contact with Atlassian Support Team, they can review those and suggest you on remediation.

Create a ticket here https://support.atlassian.com/contact/#/

Regards,

Vishwas

[Janaki Lenagala]

VA scan is done by third party. I am not sure what tool that they are using. 

I already raised a ticket with Atlassian team. But they are saying that it is not a native file from JIRA.

[Vishwas]

Got it, as you suspected it might be from some add-on. I see you have listed few add-ons, is that the list are do you have any others ?

Ask Atlassian team a question, if they can help identify which add-ons is causing this. Based on that you can directly get in touch with the vendor.

[Janaki Lenagala]

Hi Vishva,

That backbone-1.0.0 file is in the jslibs-3.0.0. jar file of JIRA. 

[Vishwas]

Hey @Janaki Lenagala 

can you just find out the exact path the file and paste it here, so that i can figure out from which plugin it is coming from. I would better suggest ask atlassian team on the ticket to tell what is this since they mentioned it was not native jira file rite?

Regards,

Vishwas

[Alex.Aleksandrov]

Hi @Janaki Lenagala, our scan reports the same vuln and I believe its caused by a plugin. Then I came across this blog. Were you able to remediate this?