Levandor

FKITDEV-8817 — esign_css jQuery Vulnerability Remediation

4 min read

FKITDEV-8817 — esign_css jQuery Vulnerability Remediation

Summary

A vulnerability scanner flagged a stale jQuery 2.2.4 file in esign_css (CVE-2020-11023, CVE-2019-11358). The flagged file is reachable by URL via nginx static serving, but the only page that references it is dead code — its routes are commented out on every active branch. Fix is a one-line repoint plus deleting the stale file; no jQuery Migrate or plugin upgrades needed.

CVEs

CVEjQuery affectedClass
CVE-2020-11023< 3.5.0XSS via <option> elements / HTML containing untrusted markup
CVE-2019-11358< 3.4.0Prototype pollution via jQuery.extend(true, {}, ...)

Root Cause

  • The flagged file is esign_css/web/libs/metronic/global/plugins/jquery.min.js — it is jQuery v2.2.4 (vulnerable).
  • Repo-wide, it is referenced in exactly one place: client/ui/layouts/auth/auth.layout.twig:73.

Key Non-Obvious Fact — auth.layout.twig is DEAD CODE

auth.layout.twig is extended only by login.template.twig and register.template.twig. The GET /login and GET /register routes that would render those templates are commented out in server/web/routes.js (lines 344 and 346) — on both devel and customization/instacash. The entire login/register page chain in esign_css is disabled. No live page renders the vulnerable jQuery.

Why the scanner still flags it

nginx serves the ^~ /libs/ location as static content by path, not by what any page references — see nginx_dev.conf / nginx_docker.conf line 27. So https://<host>/libs/metronic/global/plugins/jquery.min.js resolves and the scanner reaches it directly, even though no live page links to it.

esign_css layout topology

esign_css has exactly two Twig layouts:

LayoutStatusNotes
auth.layout.twigDeadOnly extended by disabled login/register templates
default.layout.twigLiveEvery real page extends it. Line 58 already loads the safe /libs/jquery/jquery-3.7.1.min.js

So the live side of esign_css is already on jQuery 3.7.1 — the vulnerability only exists in the dead auth layout chain.

Fix (decided)

  1. Delete the stale file esign_css/web/libs/metronic/global/plugins/jquery.min.js.
  2. Repoint the dead Twig line auth.layout.twig:73 to /libs/jquery/jquery-3.7.1.min.js (the same file default.layout.twig already uses).

No Migrate / plugin work needed

Because auth.layout.twig is dead code, there is no need for jQuery Migrate or upgrading any Metronic plugins to be 3.x-compatible. The repoint just clears the scanner finding; nothing renders the page.

bizalmiszolgaltatas.facekom.net — Separate Property

Not esign_css — needs its own owner/ticket

FKITDEV-8817 also produced jQuery findings (items 1, 2, 7, 8) against bizalmiszolgaltatas.facekom.net. This is a separate property and requires a separate owner and ticket.

  • bizalmiszolgaltatas.facekom.net is a TechTeamer-operated static document-hosting site, served via AWS CloudFront (302-redirects to the www subdomain). It is not esign_css.
  • esign_css only references it: portal.agreementUrls points at its legal PDFs:
    • /dokumentumok/aktualis/altalanos_szerzodesi_feltetelek.pdf
    • /dokumentumok/aktualis/adatkezelesi_tajekoztato.pdf
    • /dokumentumok/aktualis/bizalmi_szolgaltatasi_rend.pdf

Status 2026-05-27

Pushed, PR not yet opened — flows in via next instacash sync

Fix is implemented and pushed on bugfix/FKITDEV-8817-jquery-update in esign_css. Dead-code claim was re-verified independently. PR opening is the next step; once merged to devel, it will land on customization/instacash via the second devel→instacash merge of the 2026-05-27 update wave (parallel strategy — no need to block the wave on this PR).

ItemValue
Branchbugfix/FKITDEV-8817-jquery-update (esign_css)
Pushed to originYes
Commitb021019
Authorandras.lederer (no Claude co-author)
PRNot yet opened as of 2026-05-27
Files touched2

Files in the commit

FileChange
web/libs/metronic/global/plugins/jquery.min.jsDeleted — stale jQuery 2.2.4
client/ui/layouts/auth/auth.layout.twigRepointed <script> src to existing /libs/jquery/jquery-3.7.1.min.js (the version default.layout.twig already serves)

Dead-code claim re-verification (2026-05-27)

The “auth.layout.twig is dead code” claim from the original investigation was re-verified independently:

  • server/web/routes.js:344 (GET /login) — commented out on devel and on customization/instacash.
  • server/web/routes.js:346 (GET /register) — commented out on devel and on customization/instacash.
  • No other code path renders auth.layout.twig. The vulnerability remains unreachable through any live page; the repoint only clears the scanner finding.

Flow into InstaCash

The fix will land on InstaCash by following the standard sync path, not by a direct cherry-pick:

  1. Open PR bugfix/FKITDEV-8817-jquery-update → devel.
  2. Merge to devel.
  3. A second devel → update/customization/instacash-2026-05-27 merge will pull 8817 in along with any other new devel activity.

See instacash-update-2026-05-27-status for the wider wave context and the orphan-history gotcha in esign-css-instacash-orphan-history that may complicate step 3.

Graph View

Backlinks