Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-20668

Path traversal vulnerability in various Confluence actions

XMLWordPrintable

      We have identified and fixed a path traversal vulnerability in various Confluence actions. By exploiting a path traversal vulnerability, attackers can retrieve any file on the server that is running Confluence, based on the permissions of the user under which Confluence is running. Path traversal attacks are also called 'directory traversal' or dot-dot-slash (../) attacks.

      You can read more about path traversal attacks at Open Web Application Security Project (OWASP) and other places on the web:
      http://www.owasp.org/index.php/Path_Traversal

      Please refer to the security advisory for details of the vulnerability, risk assessment and mitigation strategies:
      http://confluence.atlassian.com/x/7ARODQ

            [CONFSERVER-20668] Path traversal vulnerability in various Confluence actions

            Don Willis added a comment -

            Don Willis added a comment -

            Jeff Kirby added a comment -

            Thank you, gentleman. Don, your URL worked great.

            Jeff Kirby added a comment - Thank you, gentleman. Don, your URL worked great.

            Don Willis added a comment -

            Hi Jeff,

            It's a system plugin, so it actually won't show up in the plugin manager.
            It should show up if you go to <baseurl>/admin/viewplugins.action?pluginKey=com.atlassian.confluence.extra.nullCharRejection.nullCharRejectionPlugin

            Don Willis added a comment - Hi Jeff, It's a system plugin, so it actually won't show up in the plugin manager. It should show up if you go to <baseurl>/admin/viewplugins.action?pluginKey=com.atlassian.confluence.extra.nullCharRejection.nullCharRejectionPlugin

            Joe Clark added a comment -

            Hi Jeff,

            I'll chase this up with the developer who wrote the plugin and find out. The plugin may hide itself from the administration console in order to prevent a malciious or inept administrator from disabling the plugin.

            Joe.

            Joe Clark added a comment - Hi Jeff, I'll chase this up with the developer who wrote the plugin and find out. The plugin may hide itself from the administration console in order to prevent a malciious or inept administrator from disabling the plugin. Joe.

            Jeff Kirby added a comment -

            Thank you for identifying this and for making a patch available for Confluence 3.3.1.
            Is it normal that the nullCharacterRejectionFilterPlugin doesn't show up in the list of installed plugins once the patch has been applied?

            Jeff Kirby added a comment - Thank you for identifying this and for making a patch available for Confluence 3.3.1. Is it normal that the nullCharacterRejectionFilterPlugin doesn't show up in the list of installed plugins once the patch has been applied?

              don.willis@atlassian.com Don Willis
              smaddox SarahA
              Affected customers:
              0 This affects my team
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: