Confluence Security Advisory 2008-12-03
In this advisory:
XSS Vulnerability in Various Confluence Actions
Severity
Atlassian rates these vulnerabilities as high, according to the scale published in Confluence Security. The scale allows us to rank a vulnerability as critical, high, moderate or low.
Risk Assessment
We have identified and fixed a number of security flaws which may affect Confluence instances in a public environment. The flaws are all XSS (cross-site scripting) vulnerabilities in various Confluence actions. Each vulnerability potentially allows a malicious user (hacker) to embed their own JavaScript into a Confluence page.
- The hacker might take advantage of the flaw to steal other users' session cookies or other credentials, by sending the credentials back to the hacker's own web server.
- The hacker's text and script might be displayed to other people viewing the Confluence page. This is potentially damaging to your company's reputation.
You can read more about XSS attacks at cgisecurity, CERT and other places on the web.
Risk Mitigation
If you judge it necessary, you can disable public access (e.g. anonymous access and public signup) to your wiki until you have applied the necessary patch or upgrade. For even tighter control, you could restrict access to trusted groups.
Vulnerability
A hacker can inject their own JavaScript into various Confluence URLs — see the table below for the affected functional areas. A URL may be invoked when a user performs a specific function in Confluence, such as clicking a link or a button. The URL can also be invoked by simply entering it into the browser address bar. If rogue JavaScript is injected into such a URL, the JavaScript will be executed when a user invokes the URL.
For more details please refer to the related JIRA issue, also shown in the table below.
Affected Confluence Functionality | Affected Confluence Versions | Fix Availability | More Details | Reporter |
|---|---|---|---|---|
Handling of error messages. (Vulnerability in the DWR code library used by Confluence.) | 2.7.3 to 2.9.2 inclusive | 2.9.2 and 2.10 | Bjoern Froebe | |
Attachments macro. | 2.8 to 2.9.2 inclusive | 2.8.2, 2.9.2 and 2.10** |
| |
Uploading of attachments. | 2.6 to 2.9.2 inclusive | 2.8.2, 2.9.2 and 2.10 |
| |
Inserting images as thumbnails. | 2.8 to 2.9.2 inclusive | 2.8.2, 2.9.2 and 2.10 |
| |
Log events listed in the Confluence 500 error page. | 2.9 to 2.9.2 inclusive | 2.10 only |
| |
Wiki Markup link rendering. | 2.7 to 2.9.2 inclusive | 2.7.x, 2.8.x, 2.9.x, 2.10 |
|
* The patch for CONF-13717 also addresses the bug in CONF-13736.
** To fix this issue, please upgrade your Attachments plugin to the latest version. This plugin is available for Confluence 2.8.2, 2.9.2 and 2.10, via the Confluence Plugin Repository.
Fix
These issues have been fixed in Confluence 2.10 (see the release notes), which you can download from the download centre.
If you do not wish to upgrade to Confluence 2.10, you can download and install the patches provided on our JIRA site. You will need to upgrade to the latest point release for the major version of Confluence that you are running (e.g. if you are running Confluence 2.8, you will need to upgrade to version 2.8.2) and then apply the patches. For more information, please refer to the specific JIRA issues shown in the table of vulnerabilities above.
Please note that one of the issues can only be fixed by upgrading to Confluence 2.10. Please see the table above for details.
Our thanks to Bjoern Froebe, who reported one of the XSS vulnerabilities listed above. We fully support the reporting of vulnerabilities and we appreciate it when people work with us to identify and solve the problem.
Users can View a List of All Attachments by Supplying an Edited URL
Severity
Atlassian rates this vulnerability as medium, according to the scale published in Confluence Security. The scale allows us to rank a vulnerability as critical, high, moderate or low.
Risk Assessment
We have identified and fixed a security flaw which allows a user to view the list of all attachments for all pages in a Confluence instance, regardless of space-level or page-level permissions.
While the user cannot open the files, a range of metadata is available for viewing, including file name, the page that the file is attached to, the creator, and the creation and last-modified date of the attachment.
Risk Mitigation
If you judge it necessary, you can disable anonymous access to your wiki until you have applied the necessary patch or upgrade.
Vulnerability
If a user removes the space key from the URL while viewing attachments for a space, Confluence will display the full list of all attachments for all spaces. For more details, please refer to CONF-13874.
Fix
These issues have been fixed in Confluence 2.10 (see the release notes), which you can download from the download centre.
If you do not wish to upgrade to Confluence 2.10, you can download and install the patches provided in the JIRA issue, CONF-13874. You will need to upgrade to the latest point release for the major version of Confluence that you are running (e.g. if you are running Confluence 2.8, you will need to upgrade to version 2.8.2) and then apply the patch.
Our thanks to Matthew Goonan, who reported this vulnerability. We fully support the reporting of vulnerabilities and we appreciate it when people work with us to identify and solve the problem.