-
Type:
Change Request
-
Status:
Closed
-
Priority:
Medium
-
Resolution:
Done
-
-
-
Module:
BenAdmin
- Security
-
-
Item State:
Production Complete
- Closed
-
Issue Importance:
Must Have
-
Vulnerability Description
Sending the new 'X-Content-Type-Options' response header with the value 'nosniff' will prevent certain browsers from MIME-sniffing a response away from the declared content-type. The missing header causes these browsers to try to determine the content-type and encoding of the response, even when these properties are defined correctly.
Impact
This can make the web application vulnerable to Cross-Site Scripting (XSS) attacks. E.g. the Internet Explorer and Safari treat responses with the content-type 'text/plain' as HTML, if they contain HTML tags.
Verification and Attack Information
Praetorian discovered this vulnerability through manual testing. Specifically, Praetorian found the "X-Content-Type-Options" header was missing from server responses of the affected system.
Recommendation
Set the following HTTP header especially in all responses which contain user input:
X-Content-Type-Options: nosniff
References
https://www.owasp.org/index.php/List_of_useful_HTTP_headers
http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
{"report":{"apdex":0.5,"isInitial":true,"journeyId":"65341032-81aa-4ef3-af5b-c5c2097bcdae","key":"jira.project.issue.view-issue","navigationType":0,"readyForUser":2187.2000002861023,"redirectCount":0,"resourceLoadedEnd":1978.5,"resourceLoadedStart":1085.9000000953674,"resourceTiming":[{"duration":577.5,"initiatorType":"link","name":"https://jira.workterra.net/s/3003653444a1e1a85555cab7dcfb3a21-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/css/_super/batch.css","startTime":1085.9000000953674,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1085.9000000953674,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1663.4000000953674,"responseStart":0,"secureConnectionStart":0},{"duration":577.4000000953674,"initiatorType":"link","name":"https://jira.workterra.net/s/dd6a0911920485696ac20493290df627-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/css/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&richediton=true","startTime":1086.3000001907349,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1086.3000001907349,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1663.7000002861023,"responseStart":0,"secureConnectionStart":0},{"duration":577.8000001907349,"initiatorType":"link","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.css","startTime":1086.4000000953674,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1086.4000000953674,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1664.2000002861023,"responseStart":0,"secureConnectionStart":0},{"duration":578.1000003814697,"initiatorType":"link","name":"https://jira.workterra.net/s/bd548f27bbf8f278bd83b60dd3284ed8-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static-adgs/jira.webresources:global-static-adgs.css","startTime":1086.5,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1086.5,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1664.6000003814697,"responseStart":0,"secureConnectionStart":0},{"duration":578.5999999046326,"initiatorType":"link","name":"https://jira.workterra.net/s/70725731a158a7140f19ddbd4201ba27-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static/jira.webresources:global-static.css","startTime":1086.6000003814697,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1086.6000003814697,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1665.2000002861023,"responseStart":0,"secureConnectionStart":0},{"duration":719.4000000953674,"initiatorType":"script","name":"https://jira.workterra.net/s/f2623af22c15df767ec6ff268ae0b8bd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/js/_super/batch.js?locale=en-US","startTime":1086.8000001907349,"connectEnd":1086.8000001907349,"connectStart":1086.8000001907349,"domainLookupEnd":1086.8000001907349,"domainLookupStart":1086.8000001907349,"fetchStart":1086.8000001907349,"redirectEnd":0,"redirectStart":0,"requestStart":1667.6000003814697,"responseEnd":1806.2000002861023,"responseStart":1700,"secureConnectionStart":1086.8000001907349},{"duration":851.9000000953674,"initiatorType":"script","name":"https://jira.workterra.net/s/6ce676f2a5bcc9651cef6e7956f05def-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/js/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":1087.5,"connectEnd":1087.5,"connectStart":1087.5,"domainLookupEnd":1087.5,"domainLookupStart":1087.5,"fetchStart":1087.5,"redirectEnd":0,"redirectStart":0,"requestStart":1668.5,"responseEnd":1939.4000000953674,"responseStart":1703,"secureConnectionStart":1087.5},{"duration":665.0999999046326,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/4.1.5/_/download/resources/com.atlassian.plugins.atlassian-chaperone:hotspot-tour/hotspot-tour.js?batch=false&locale=en-US","startTime":1087.6000003814697,"connectEnd":1087.6000003814697,"connectStart":1087.6000003814697,"domainLookupEnd":1087.6000003814697,"domainLookupStart":1087.6000003814697,"fetchStart":1087.6000003814697,"redirectEnd":0,"redirectStart":0,"requestStart":1669.5,"responseEnd":1752.7000002861023,"responseStart":1752.2000002861023,"secureConnectionStart":1087.6000003814697},{"duration":639.5999999046326,"initiatorType":"script","name":"https://jira.workterra.net/s/6aa3fcf1fac5fd551eee0b69077524e6-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/aae1242f5fc81cc6a5bb8bc963ccda29/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en-US","startTime":1087.7000002861023,"connectEnd":1087.7000002861023,"connectStart":1087.7000002861023,"domainLookupEnd":1087.7000002861023,"domainLookupStart":1087.7000002861023,"fetchStart":1087.7000002861023,"redirectEnd":0,"redirectStart":0,"requestStart":1670.5,"responseEnd":1727.3000001907349,"responseStart":1726.4000000953674,"secureConnectionStart":1087.7000002861023},{"duration":665.8000001907349,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":1087.9000000953674,"connectEnd":1087.9000000953674,"connectStart":1087.9000000953674,"domainLookupEnd":1087.9000000953674,"domainLookupStart":1087.9000000953674,"fetchStart":1087.9000000953674,"redirectEnd":0,"redirectStart":0,"requestStart":1671.7000002861023,"responseEnd":1753.7000002861023,"responseStart":1752.9000000953674,"secureConnectionStart":1087.9000000953674},{"duration":666.4000000953674,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":1087.9000000953674,"connectEnd":1087.9000000953674,"connectStart":1087.9000000953674,"domainLookupEnd":1087.9000000953674,"domainLookupStart":1087.9000000953674,"fetchStart":1087.9000000953674,"redirectEnd":0,"redirectStart":0,"requestStart":1672.7000002861023,"responseEnd":1754.3000001907349,"responseStart":1753.8000001907349,"secureConnectionStart":1087.9000000953674},{"duration":667.2000002861023,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.js?locale=en-US","startTime":1088,"connectEnd":1088,"connectStart":1088,"domainLookupEnd":1088,"domainLookupStart":1088,"fetchStart":1088,"redirectEnd":0,"redirectStart":0,"requestStart":1674.6000003814697,"responseEnd":1755.2000002861023,"responseStart":1754.4000000953674,"secureConnectionStart":1088},{"duration":585.0999999046326,"initiatorType":"link","name":"https://jira.workterra.net/s/05c862146699bb029ceb0a489075e63b-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/bcd66e9a133a1b9f5fd14b56841e1c5b/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":1088.1000003814697,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1088.1000003814697,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1673.2000002861023,"responseStart":0,"secureConnectionStart":0},{"duration":670.2999997138977,"initiatorType":"script","name":"https://jira.workterra.net/rest/api/1.0/shortcuts/805012/ea6f30d2bfdc99578bb23f4a5bac3ecd/shortcuts.js?context=issuenavigation&context=issueaction","startTime":1088.2000002861023,"connectEnd":1088.2000002861023,"connectStart":1088.2000002861023,"domainLookupEnd":1088.2000002861023,"domainLookupStart":1088.2000002861023,"fetchStart":1088.2000002861023,"redirectEnd":0,"redirectStart":0,"requestStart":1679.2000002861023,"responseEnd":1758.5,"responseStart":1757.5,"secureConnectionStart":1088.2000002861023},{"duration":586.5,"initiatorType":"link","name":"https://jira.workterra.net/s/9095228fa10daa2d3e3d7d5760c95e91-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.css?jira.create.linked.issue=true&richediton=true","startTime":1088.4000000953674,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1088.4000000953674,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1674.9000000953674,"responseStart":0,"secureConnectionStart":0},{"duration":669,"initiatorType":"script","name":"https://jira.workterra.net/s/c19a1b46e985d7fb85efaf27c8febfdd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.js?jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":1088.4000000953674,"connectEnd":1088.4000000953674,"connectStart":1088.4000000953674,"domainLookupEnd":1088.4000000953674,"domainLookupStart":1088.4000000953674,"fetchStart":1088.4000000953674,"redirectEnd":0,"redirectStart":0,"requestStart":1677.2000002861023,"responseEnd":1757.4000000953674,"responseStart":1755.3000001907349,"secureConnectionStart":1088.4000000953674},{"duration":856.5,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":1111.1000003814697,"connectEnd":1111.1000003814697,"connectStart":1111.1000003814697,"domainLookupEnd":1111.1000003814697,"domainLookupStart":1111.1000003814697,"fetchStart":1111.1000003814697,"redirectEnd":0,"redirectStart":0,"requestStart":1815.8000001907349,"responseEnd":1967.6000003814697,"responseStart":1966.8000001907349,"secureConnectionStart":1111.1000003814697},{"duration":867.2999997138977,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":1111.2000002861023,"connectEnd":1111.2000002861023,"connectStart":1111.2000002861023,"domainLookupEnd":1111.2000002861023,"domainLookupStart":1111.2000002861023,"fetchStart":1111.2000002861023,"redirectEnd":0,"redirectStart":0,"requestStart":1886.7000002861023,"responseEnd":1978.5,"responseStart":1978,"secureConnectionStart":1111.2000002861023},{"duration":98.69999980926514,"initiatorType":"xmlhttprequest","name":"https://jira.workterra.net/rest/webResources/1.0/resources","startTime":1935.7000002861023,"connectEnd":1935.7000002861023,"connectStart":1935.7000002861023,"domainLookupEnd":1935.7000002861023,"domainLookupStart":1935.7000002861023,"fetchStart":1935.7000002861023,"redirectEnd":0,"redirectStart":0,"requestStart":2000.9000000953674,"responseEnd":2034.4000000953674,"responseStart":2033.8000001907349,"secureConnectionStart":1935.7000002861023}],"threshold":1000,"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":801,"connectEnd":970,"secureConnectionStart":938,"requestStart":971,"responseStart":1058,"responseEnd":1110,"domLoading":1062,"domInteractive":2243,"domContentLoadedEventStart":2243,"domContentLoadedEventEnd":2293,"domComplete":2781,"loadEventStart":2781,"loadEventEnd":2783,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[],"measures":[],"correlationId":"3fb00e55b7446","effectiveType":"4g","downlink":10,"rtt":0,"serverDuration":47,"dbReadsTimeInMs":15,"dbConnsTimeInMs":16,"applicationHash":"156decd7d2b4272533aa6cefc8294af635e1da97","experiments":[]}}
Zeeshan Chishty (Inactive)
added a comment - Verified as X-Content Type Options Response header was implemented to 'nosniff' 
Gokul Sonawane (Inactive)
added a comment - Deployed on stage
HTTP Response Header
Name : X-Content-Type-Options
Value : nosniff
For Testing :
1. Open Login Page --> Inspect Element --> Network Tab --> Reload Page (Ctrl + F5)
2. Check Response Headers of all files --> X-Content-Type-Options attribute is Added.
Help URL:
https://www.veracode.com/blog/2014/03/guidelines-for-setting-security-headers
https://scotthelme.co.uk/hardening-your-http-response-headers/
http://webtonio.com/iis-image-not-loading/