Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-2950

Crowd leaks the value of the HTTP only 'crowd.token_key' cookie on the crowd/console/500.jsp page

XMLWordPrintable

      cert.fr@cassidian.com reported the following vulnerability:
      == Type ==
      Information Disclosure

      == Product ==
      Atlassian Crowd

      == Severity ==
      Medium

      == Description ==
      The crowd.token_key cookie, used as a token to authenticate on all Atlassian applications, is marked as HttpOnly.
      However, the Crowd 500 error page (/crowd/console/500.jsp) displays this cookie?s value, breaking the HttpOnly behavior.

            [CWD-2950] Crowd leaks the value of the HTTP only 'crowd.token_key' cookie on the crowd/console/500.jsp page

            joe added a comment -

            500.jsp iterates over the session properties before printing them. Add a check and replace crowd.token_key's value with XXXs. The cookie name can be configured: for a proper fix we'll need to check the current name.

            joe added a comment - 500.jsp iterates over the session properties before printing them. Add a check and replace crowd.token_key 's value with XXXs. The cookie name can be configured: for a proper fix we'll need to check the current name.

              akunday ArvindA
              dblack David Black
              Affected customers:
              0 This affects my team
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved:

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - Not Specified
                  Not Specified
                  Logged:
                  Time Spent - 53m
                  53m