-
Type:
Bug
-
Status:
In Development
-
Priority:
Low
-
Resolution:
Unresolved
-
Affects Version/s:
None
-
Fix Version/s:
None
-
Component/s:
None
-
-
-
-
-
Module:
BenAdmin
- Security
-
-
Company:
All Clients/Multiple Clients
-
Item State:
Development
- In Analysis
A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript. If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site. If this is a session cookie then session hijacking may be possible.
For more details please refer attached HTML report
CC SamirRakesh RoyJaideep Vinchurkaranirudha joshi
SearchEmp_Spider.html
- relates to
-
NF-2714
Vulnerability Assessment and Penetration Testing for Workterra on Azure US environment.
-
-
To Do
{"report":{"apdex":1,"isInitial":true,"journeyId":"8116778b-e629-4025-9e31-0a8e7012e640","key":"jira.project.issue.view-issue","navigationType":0,"readyForUser":885.2999999523163,"redirectCount":0,"resourceLoadedEnd":814.7999999523163,"resourceLoadedStart":222.5,"resourceTiming":[{"duration":93.09999990463257,"initiatorType":"link","name":"https://jira.workterra.net/s/3003653444a1e1a85555cab7dcfb3a21-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/css/_super/batch.css","startTime":222.5,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":222.5,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":315.59999990463257,"responseStart":0,"secureConnectionStart":0},{"duration":94,"initiatorType":"link","name":"https://jira.workterra.net/s/dd6a0911920485696ac20493290df627-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/css/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&richediton=true","startTime":222.79999995231628,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":222.79999995231628,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":316.7999999523163,"responseStart":0,"secureConnectionStart":0},{"duration":94.39999985694885,"initiatorType":"link","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.css","startTime":222.90000009536743,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":222.90000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":317.2999999523163,"responseStart":0,"secureConnectionStart":0},{"duration":176.40000009536743,"initiatorType":"link","name":"https://jira.workterra.net/s/bd548f27bbf8f278bd83b60dd3284ed8-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static-adgs/jira.webresources:global-static-adgs.css","startTime":223,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":223,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":399.40000009536743,"responseStart":0,"secureConnectionStart":0},{"duration":176.80000019073486,"initiatorType":"link","name":"https://jira.workterra.net/s/70725731a158a7140f19ddbd4201ba27-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static/jira.webresources:global-static.css","startTime":223.09999990463257,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":223.09999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":399.90000009536743,"responseStart":0,"secureConnectionStart":0},{"duration":224.59999990463257,"initiatorType":"script","name":"https://jira.workterra.net/s/f2623af22c15df767ec6ff268ae0b8bd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/js/_super/batch.js?locale=en-US","startTime":223.20000004768372,"connectEnd":223.20000004768372,"connectStart":223.20000004768372,"domainLookupEnd":223.20000004768372,"domainLookupStart":223.20000004768372,"fetchStart":223.20000004768372,"redirectEnd":0,"redirectStart":0,"requestStart":223.20000004768372,"responseEnd":447.7999999523163,"responseStart":447.7999999523163,"secureConnectionStart":223.20000004768372},{"duration":264.60000014305115,"initiatorType":"script","name":"https://jira.workterra.net/s/6ce676f2a5bcc9651cef6e7956f05def-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/js/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":223.29999995231628,"connectEnd":223.29999995231628,"connectStart":223.29999995231628,"domainLookupEnd":223.29999995231628,"domainLookupStart":223.29999995231628,"fetchStart":223.29999995231628,"redirectEnd":0,"redirectStart":0,"requestStart":223.29999995231628,"responseEnd":487.90000009536743,"responseStart":487.90000009536743,"secureConnectionStart":223.29999995231628},{"duration":267.59999990463257,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/4.1.5/_/download/resources/com.atlassian.plugins.atlassian-chaperone:hotspot-tour/hotspot-tour.js?batch=false&locale=en-US","startTime":223.40000009536743,"connectEnd":223.40000009536743,"connectStart":223.40000009536743,"domainLookupEnd":223.40000009536743,"domainLookupStart":223.40000009536743,"fetchStart":223.40000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":223.40000009536743,"responseEnd":491,"responseStart":491,"secureConnectionStart":223.40000009536743},{"duration":267.90000009536743,"initiatorType":"script","name":"https://jira.workterra.net/s/6aa3fcf1fac5fd551eee0b69077524e6-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/aae1242f5fc81cc6a5bb8bc963ccda29/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en-US","startTime":223.59999990463257,"connectEnd":223.59999990463257,"connectStart":223.59999990463257,"domainLookupEnd":223.59999990463257,"domainLookupStart":223.59999990463257,"fetchStart":223.59999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":223.59999990463257,"responseEnd":491.5,"responseStart":491.5,"secureConnectionStart":223.59999990463257},{"duration":268.39999985694885,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":223.70000004768372,"connectEnd":223.70000004768372,"connectStart":223.70000004768372,"domainLookupEnd":223.70000004768372,"domainLookupStart":223.70000004768372,"fetchStart":223.70000004768372,"redirectEnd":0,"redirectStart":0,"requestStart":223.70000004768372,"responseEnd":492.09999990463257,"responseStart":492.09999990463257,"secureConnectionStart":223.70000004768372},{"duration":268.7999999523163,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":223.79999995231628,"connectEnd":223.79999995231628,"connectStart":223.79999995231628,"domainLookupEnd":223.79999995231628,"domainLookupStart":223.79999995231628,"fetchStart":223.79999995231628,"redirectEnd":0,"redirectStart":0,"requestStart":223.79999995231628,"responseEnd":492.59999990463257,"responseStart":492.59999990463257,"secureConnectionStart":223.79999995231628},{"duration":269.09999990463257,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.js?locale=en-US","startTime":223.90000009536743,"connectEnd":223.90000009536743,"connectStart":223.90000009536743,"domainLookupEnd":223.90000009536743,"domainLookupStart":223.90000009536743,"fetchStart":223.90000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":223.90000009536743,"responseEnd":493,"responseStart":493,"secureConnectionStart":223.90000009536743},{"duration":269.40000009536743,"initiatorType":"link","name":"https://jira.workterra.net/s/05c862146699bb029ceb0a489075e63b-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/bcd66e9a133a1b9f5fd14b56841e1c5b/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":224.09999990463257,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":224.09999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":493.5,"responseStart":0,"secureConnectionStart":0},{"duration":269.40000009536743,"initiatorType":"script","name":"https://jira.workterra.net/rest/api/1.0/shortcuts/805012/344f6dde0e779bc821c159302c8a4389/shortcuts.js?context=issuenavigation&context=issueaction","startTime":224.09999990463257,"connectEnd":224.09999990463257,"connectStart":224.09999990463257,"domainLookupEnd":224.09999990463257,"domainLookupStart":224.09999990463257,"fetchStart":224.09999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":224.09999990463257,"responseEnd":493.5,"responseStart":493.5,"secureConnectionStart":224.09999990463257},{"duration":269.89999985694885,"initiatorType":"link","name":"https://jira.workterra.net/s/9095228fa10daa2d3e3d7d5760c95e91-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.css?jira.create.linked.issue=true&richediton=true","startTime":224.20000004768372,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":224.20000004768372,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":494.09999990463257,"responseStart":0,"secureConnectionStart":0},{"duration":269.7999999523163,"initiatorType":"script","name":"https://jira.workterra.net/s/c19a1b46e985d7fb85efaf27c8febfdd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.js?jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":224.40000009536743,"connectEnd":224.40000009536743,"connectStart":224.40000009536743,"domainLookupEnd":224.40000009536743,"domainLookupStart":224.40000009536743,"fetchStart":224.40000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":224.40000009536743,"responseEnd":494.2000000476837,"responseStart":494.2000000476837,"secureConnectionStart":224.40000009536743},{"duration":588.7000000476837,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":225.29999995231628,"connectEnd":225.29999995231628,"connectStart":225.29999995231628,"domainLookupEnd":225.29999995231628,"domainLookupStart":225.29999995231628,"fetchStart":225.29999995231628,"redirectEnd":0,"redirectStart":0,"requestStart":225.29999995231628,"responseEnd":814,"responseStart":814,"secureConnectionStart":225.29999995231628},{"duration":589.3999998569489,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":225.40000009536743,"connectEnd":225.40000009536743,"connectStart":225.40000009536743,"domainLookupEnd":225.40000009536743,"domainLookupStart":225.40000009536743,"fetchStart":225.40000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":225.40000009536743,"responseEnd":814.7999999523163,"responseStart":814.7999999523163,"secureConnectionStart":225.40000009536743},{"duration":170.20000004768372,"initiatorType":"xmlhttprequest","name":"https://jira.workterra.net/rest/webResources/1.0/resources","startTime":642.7000000476837,"connectEnd":642.7000000476837,"connectStart":642.7000000476837,"domainLookupEnd":642.7000000476837,"domainLookupStart":642.7000000476837,"fetchStart":642.7000000476837,"redirectEnd":0,"redirectStart":0,"requestStart":642.7000000476837,"responseEnd":812.9000000953674,"responseStart":812.9000000953674,"secureConnectionStart":642.7000000476837}],"threshold":1000,"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":134,"responseStart":217,"responseEnd":218,"domLoading":221,"domInteractive":945,"domContentLoadedEventStart":945,"domContentLoadedEventEnd":996,"domComplete":1596,"loadEventStart":1596,"loadEventEnd":1598,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[],"measures":[],"correlationId":"3192a3e91239d","effectiveType":"4g","downlink":9,"rtt":0,"serverDuration":63,"dbReadsTimeInMs":11,"dbConnsTimeInMs":12,"applicationHash":"156decd7d2b4272533aa6cefc8294af635e1da97","experiments":[]}}
Yes, we need to take care of this. While development we need to handle this such way that, we should pass a cookie value from server side code to function in java script code , so that after making 'IdForLoginValidation' cookie as HTTPOnly, there will not be an issue while reading this cookie value in java script, as currently we are accessing this cookie inside WORKTERRALogin.js to check user session.