Confluence Docs 3.0 : Confluence Security Advisory 2009-10-06 This page last changed on Oct 06, 2009 by ggaskell. In this advisory: Session Fixation Vulnerability Severity Risk Assessment Risk Mitigation Vulnerability Fix XSS Vulnerability in Various Confluence Macros Severity Risk Assessment Risk Mitigation Vulnerability Fix ## Session Fixation Vulnerability #### Severity Atlassian rates these vulnerabilities as high, according to the scale published in Confluence Security. The scale allows us to rank a vulnerability as critical, high, moderate or low. #### Risk Assessment We have identified and fixed a security vulnerability which may affect Confluence instances in a public environment. This vulnerability could lead to a session fixation attack, in which the malicious user (attacker) can gain access to a victim's Confluence resources whilst the victim is logged in to their Confluence user account. The attacker does this by fixating (or setting) their session ID onto the victim's computer. While the victim is logged in, all the victim's privileges are associated with the attacker's session ID, effectively granting the attacker access to all of the Confluence data and resources accessible to the victim. For more information about session fixation attacks, please refer to the following sources: Chris Shiflett's Security Corner article The Web Application Security Consortium's overview #### Risk Mitigation We recommend either patching or upgrading your Confluence installation to fix these vulnerabilities. Please see the 'Fix' section below. Alternatively, if you are not in a position to undertake this immediately and you judge it necessary, you can disable public access (e.g. anonymous access and public sign-on) to your wiki until you have applied the necessary patch or upgrade. For even tighter control, you could restrict access to trusted groups. #### Vulnerability All versions of Confluence prior to 3.0.2 are vulnerable to this security issue. #### Fix These issues have been fixed in Confluence 3.0.2 (see the release notes), which you can download from the download centre. If you do not wish to upgrade to Confluence 3.0.2 and you are currently running Confluence version 2.10.x or 3.0.x, you can patch your existing installation by downloading the appropriate patch file attached to JIRA issue CONF-15108 and installing the patch file using the instructions provided in this JIRA issue. Our thanks to Ben L Broussard who reported this vulnerability. We fully support the reporting of vulnerabilities and we appreciate it when people work with us to identify and solve the problem. ## XSS Vulnerability in Various Confluence Macros #### Severity Atlassian rates these vulnerabilities as high, according to the scale published in Confluence Security. The scale allows us to rank a vulnerability as critical, high, moderate or low. #### Risk Assessment We have identified and fixed a number of security vulnerabilities which may affect Confluence instances in a public environment. These flaws are cross-site scripting (XSS) vulnerabilities in Confluence's pagetree, userlister and content by label macros. These XSS vulnerabilities potentially allow an attacker to embed their own JavaScript into a Confluence page. The attacker might take advantage of the vulnerability to steal other users' session cookies or other credentials, by sending the credentials back to the attacker's own web server. The attacker's text and script might be displayed to other people viewing the Confluence page. This is potentially damaging to your company's reputation. You can read more about XSS attacks at cgisecurity, CERT and other places on the web. #### Risk Mitigation We recommend either patching or upgrading your Confluence installation to fix these vulnerabilities. Please see the 'Fix' section below. Alternatively, if you are not in a position to undertake this immediately and you judge it necessary, you can disable public access (e.g. anonymous access and public sign-on) to your wiki until you have applied the necessary patch or upgrade. For even tighter control, you could restrict access to trusted groups. #### Vulnerability An attacker can inject their own JavaScript into the Confluence actions listed in the table below. Each of the actions is invoked when a user performs a specific function in Confluence, such as clicking a link or a button. The actions can also be invoked by simply entering the URL into the browser address bar. The rogue JavaScript will be executed when a user invokes the URL. For more details please refer to the related JIRA issue, also shown in the table below.
Confluence action | Affected Confluence Versions | Fix Availability | More Details
--- | --- | --- | ---
Pagetree Macro | 2.8.0 – 3.0.1 | 2.10.0 – 3.0.2 inclusive | CONF-16651
Userlister Macro | 2.6.0 – 3.0.1 | 2.10.0 – 3.0.2 inclusive | CONF-16644
Content by Label Macro | 2.10.0 – 3.0.1 | 2.10.0 – 3.0.2 inclusive | CONF-15440
#### Fix These issues have been fixed in Confluence 3.0.2 (see the release notes), which you can download from the download centre. If you do not wish to upgrade to Confluence 3.0.2, you can patch your existing installation by upgrading the plugins for these macros via the Confluence Plugin Repository to the version indicated in the JIRA issues listed in the vulnerability section (above).

Document generated by Confluence on Nov 05, 2009 23:27