SEC Consult Vulnerability Lab Security Advisory < 20141029-1 > ======================================================================= title: Persistent cross site scripting product: Confluence RefinedWiki Original Theme vulnerable version: 3.x - 4.0.x fixed version: 4.0.12 impact: high homepage: http://www.refinedwiki.com/ found: 2014-08-07 by: Manuel Hofer SEC Consult Vulnerability Lab https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "RefinedWiki Original Theme is the perfect add-on for smarter collaboration and documentation. It can turn Confluence into an Intranet or Extranet and with improved organization, more intuitive navigation and customizable designs, your whole team will love using Confluence." http://www.refinedwiki.com/en/display/products.aspx Business recommendation: ------------------------ By exploiting this vulnerability, users that are able to create or edit content, can attack other users of confluence. An attacker might be able to gain access to otherwise protected information in confluence. It is recommended to upgrade to the latest version of RefinedWiki Original Theme. Vulnerability overview/description: ----------------------------------- 1) Persistent Cross-Site Scripting The vulnerability can be used to persistently include HTML- or JavaScript code to the "Activity Stream" of confluence. The code is executed in the browser of users if they visit the manipulated site. The vulnerability can be used to change the contents of the displayed site, redirect to other sites or steal user credentials. Additionally, confluence users are potential victims of browser exploits and JavaScript Trojans. Proof of concept: ----------------- 1) Persistent Cross-Site Scripting A user with the necessary permissions to create or edit content in Confluence can exploit this vulnerability by placing the XSS payload inside the vulnerable POST parameter "versionComment" as shown in the following request. > POST /pages/doeditpage.action?pageId=111111 HTTP/1.1 > [...] > atl_token=5aabd74e50724eaac8290a3447d9f6e7a179559e&originalVersion=5 > &title=Title&wysiwygContent=[REMOVED]&watchPageAfterComment=true > &versionComment=<script>alert(document.cookie)</script> > &notifyWatchers=true&confirm=Save&viewPermissionsUsers= > &editPermissionsUsers=&viewPermissionsGroups=&editPermissionsGroups= > &parentPageString=&moveHierarchy=true&position=&targetId=&draftId=0 > &entityId=9012708&newSpaceKey=tools The submitted XSS payload gets executed every time a user visits the activity stream of the edited page. Vulnerable / tested versions: ----------------------------- According to the vendor, the affected versions are RefinedWiki Original Theme are 3.x - 4.0.x. Vendor contact timeline: ------------------------ 2014-08-08: Contacting Atlassian through issue tracking platform at https://jira.atlassian.com/browse/CONF-34525 2014-08-15: Issue identified as part of the RefinedWiki Original Theme and not Confluence itself. Atlassian forwards advisory to RefinedWiki team 2014-08-15: Vendor acknowledges the vulnerability 2014-08-18: Vendor provides fixed version 2014-08-27: Vendor releases fixed version to the public 2014-10-29: SEC Consult releases security advisory Solution: --------- Upgrade to the latest version available: http://demo.refinedwiki.com/display/rwot/Version+4.0.12 Fixes are also included in version 3.5.13 and version 4.1 Workaround: ----------- - Advisory URL: ------------- https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab SEC Consult Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius - Zurich Headquarter: Mooslackengasse 17, 1190 Vienna, Austria Phone: +43 1 8903043 0 Fax: +43 1 8903043 15 Mail: research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult Interested to work with the experts of SEC Consult? Write to career@sec-consult.com EOF Manuel Hofer / @2014