This server will be upgraded at 3pm Sydney time on December 3rd (December 2nd, 8pm PST) and will be down for up to 30 minutes.
This documentation relates to the latest version of Confluence.
If you are using an earlier version, please go to the documentation home page and select the relevant version.

Confluence Security Advisory 2005-12-05

Added by Daniel Ostermeier, last edited by Charles Miller on Dec 04, 2005  (view change)
All Versions
Click for all versions
Confluence 2.10 Documentation

Index

A flaw has been found in Confluence by which attackers to inject malicious HTML code into Confluence. Atlassian STRONGLY recommends that all Confluence customers apply the fix described below immediately, or upgrade to Confluence 2.0.2

Vulnerability

By entering HTML code into the Confluence search input fields, attackers can cause arbitrary scripting code to be executed by the user's browser in the security context of the Confluence instance.

This flaw affects all versions of Confluence between 1.4-DR releases and 2.0.1.

(Atlassian was not informed of the problem before it was published by third-party security researchers. You can read the third-party security advisory here: http://secunia.com/advisories/17833/. The vulnerability was originally reported here.)

Fix

This vulnerability is fixed in Confluence 2.0.2 and later. Customers who do not wish to migrate to 2.0.2 can fix this bug using the procedure below:

  1. Edit the confluence/decorators/components/searchresults.vmd
  2. Replace the following reference (around line 48): 
    $action.getText("search.result", [$start, $end, $total, $queryString])

    with 
    $action.getText("search.result", [$start, $end, $total, $generalUtil.escapeXml($queryString)]).


  3. Edit the confluence/search/searchsite-results.vm.
  4. Replace the following reference (around line 11): 
    Searched for <b>$action.searchQuery.queryString</b>

    with 
    Searched for <b>$generalUtil.escapeXml($action.searchQuery.queryString)</b>


  5. Restart Confluence.

Alternatively, you can download the patched source files from CONF-4825. If you are patching a 2.0.x installation, then use the files with the .2.0 suffix. If you are patching a 1.4.x installation, then use the files with the .1.4 suffix.

Labels

administration administration Delete
security-advisory security-advisory Delete
Enter labels to add to this page:
Please wait 
Looking for a label? Just start typing.