what you don't know can hurt you

Confluence RefinedWiki Original Theme Cross Site Scripting

Confluence RefinedWiki Original Theme Cross Site Scripting
Posted Oct 29, 2014
Authored by Manuel Hofer | Site sec-consult.com

Confluence RefinedWiki Original Theme versions 3.x through 4.0.x suffer from a persistent cross site scripting vulnerability.

tags | exploit, xss
MD5 | 41ef09eddf4a336af9a4729f9a2db14b

Confluence RefinedWiki Original Theme Cross Site Scripting

Change Mirror Download
SEC Consult Vulnerability Lab Security Advisory < 20141029-1 >
=======================================================================
title: Persistent cross site scripting
product: Confluence RefinedWiki Original Theme
vulnerable version: 3.x - 4.0.x
fixed version: 4.0.12
impact: high
homepage: http://www.refinedwiki.com/
found: 2014-08-07
by: Manuel Hofer
SEC Consult Vulnerability Lab
https://www.sec-consult.com
=======================================================================

Vendor description:
-------------------
"RefinedWiki Original Theme is the perfect add-on for smarter collaboration
and documentation. It can turn Confluence into an Intranet or Extranet and
with improved organization, more intuitive navigation and customizable
designs, your whole team will love using Confluence."

http://www.refinedwiki.com/en/display/products.aspx

Business recommendation:
------------------------
By exploiting this vulnerability, users that are able to create or edit
content, can attack other users of confluence. An attacker might be able to
gain access to otherwise protected information in confluence.

It is recommended to upgrade to the latest version of RefinedWiki Original
Theme.

Vulnerability overview/description:
-----------------------------------
1) Persistent Cross-Site Scripting

The vulnerability can be used to persistently include HTML- or JavaScript
code to the "Activity Stream" of confluence. The code is executed in the
browser of users if they visit the manipulated site. The vulnerability can be
used to change the contents of the displayed site, redirect to other sites or
steal user credentials. Additionally, confluence users are potential victims
of browser exploits and JavaScript Trojans.


Proof of concept:
-----------------
1) Persistent Cross-Site Scripting
A user with the necessary permissions to create or edit content in Confluence
can exploit this vulnerability by placing the XSS payload inside the
vulnerable POST parameter "versionComment" as shown in the following request.

> POST /pages/doeditpage.action?pageId=111111 HTTP/1.1
> [...]
> atl_token=5aabd74e50724eaac8290a3447d9f6e7a179559e&originalVersion=5
> &title=Title&wysiwygContent=[REMOVED]&watchPageAfterComment=true
> &versionComment=<script>alert(document.cookie)</script>
> &notifyWatchers=true&confirm=Save&viewPermissionsUsers=
> &editPermissionsUsers=&viewPermissionsGroups=&editPermissionsGroups=
> &parentPageString=&moveHierarchy=true&position=&targetId=&draftId=0
> &entityId=9012708&newSpaceKey=tools

The submitted XSS payload gets executed every time a user visits the activity
stream of the edited page.


Vulnerable / tested versions:
-----------------------------
According to the vendor, the affected versions are RefinedWiki Original Theme
are 3.x - 4.0.x.


Vendor contact timeline:
------------------------
2014-08-08: Contacting Atlassian through issue tracking platform at
https://jira.atlassian.com/browse/CONF-34525
2014-08-15: Issue identified as part of the RefinedWiki Original Theme and not
Confluence itself. Atlassian forwards advisory to RefinedWiki team
2014-08-15: Vendor acknowledges the vulnerability
2014-08-18: Vendor provides fixed version
2014-08-27: Vendor releases fixed version to the public
2014-10-29: SEC Consult releases security advisory


Solution:
---------
Upgrade to the latest version available:
http://demo.refinedwiki.com/display/rwot/Version+4.0.12

Fixes are also included in version 3.5.13 and version 4.1

Workaround:
-----------
-


Advisory URL:
-------------
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab

SEC Consult
Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius - Zurich

Headquarter:
Mooslackengasse 17, 1190 Vienna, Austria
Phone: +43 1 8903043 0
Fax: +43 1 8903043 15

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

Interested to work with the experts of SEC Consult?
Write to career@sec-consult.com

EOF Manuel Hofer / @2014

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    1 Files
  • 2
    Feb 2nd
    2 Files
  • 3
    Feb 3rd
    17 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    16 Files
  • 7
    Feb 7th
    19 Files
  • 8
    Feb 8th
    1 Files
  • 9
    Feb 9th
    2 Files
  • 10
    Feb 10th
    15 Files
  • 11
    Feb 11th
    20 Files
  • 12
    Feb 12th
    12 Files
  • 13
    Feb 13th
    18 Files
  • 14
    Feb 14th
    17 Files
  • 15
    Feb 15th
    4 Files
  • 16
    Feb 16th
    4 Files
  • 17
    Feb 17th
    34 Files
  • 18
    Feb 18th
    15 Files
  • 19
    Feb 19th
    19 Files
  • 20
    Feb 20th
    20 Files
  • 21
    Feb 21st
    15 Files
  • 22
    Feb 22nd
    2 Files
  • 23
    Feb 23rd
    2 Files
  • 24
    Feb 24th
    16 Files
  • 25
    Feb 25th
    37 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close