Version Disclosure

[alkistis500]

Hello,

Version Disclosure (React) is reported against Jaeger UI by Netsparker tool.

Any ideas of how this can be fixed?

Thanks!

[dosubot[bot]]

Hey @alkistis500! I'm here to help you with any bugs or questions you have. Let's tackle this together!

To address the version disclosure vulnerability in the Jaeger UI, you can consider the following steps:

1. Remove Version Information from UI: Ensure that the version information is not displayed in the UI or exposed through any API endpoints. In the Jaeger UI, version information is included in the "About Jaeger" section of the menu configuration. You can modify or remove these entries in the default-config.tsx file to prevent disclosure ^[1].

2. Avoid Embedding Version in JavaScript: If the version is embedded in JavaScript files, consider removing it or obfuscating it to prevent easy access by tools like Netsparker.

3. Use Environment Variables: Instead of hardcoding version information, use environment variables to manage version details securely on the server side, ensuring they are not exposed to the client.

4. Review and Update Dependencies: Regularly review and update your dependencies to ensure you are using the latest versions, which may include security patches for known vulnerabilities.

By implementing these measures, you can reduce the risk of version disclosure in your application.

To continue talking to Dosu, mention @dosu.

[alkistis500]

Thanks for the prompt answer.

Actually the version disclosure is reported for React package used by Jaeger UI.
In an HTTP 200 OK response the body contains detailed info from React package.
In Jaeger UI yarn.lock react (18.3.1) and react-is (16.13.1) packages are present.

Thanks