Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-25541

multimedia macro allows execution of arbitrary scripts

XMLWordPrintable

      The

      {multimedia} macro in confluence embeds a swf without the 'allowScriptAccess' attribute set to 'none'. This allows the embedded (user submitted) swf to execute arbitrary javascript on the page, constituting an XSS vulnerability. The {multimedia}

      tag is bundled in with the base product and not an optional macro, so steps may need to be taken by Atlassian to fix this issue if there isn't a configuration setting anywhere.

      This issue was reported by Workday's Security Operations team member Michael Carlson

        1. HelloWorld.as
          0.3 kB
          David Corley
        2. HelloWorld.swf
          1 kB
          David Corley

            [CONFSERVER-25541] multimedia macro allows execution of arbitrary scripts

            Katherine Yabut made changes -
            Workflow Original: JAC Bug Workflow v3 [ 2875325 ] New: CONFSERVER Bug Workflow v4 [ 3004986 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow v2 [ 2803296 ] New: JAC Bug Workflow v3 [ 2875325 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow [ 2735977 ] New: JAC Bug Workflow v2 [ 2803296 ]
            Owen made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2394755 ] New: JAC Bug Workflow [ 2735977 ]
            Alex Yakovlev (Inactive) made changes -
            Labels Original: affects-server bugfix cvss-high editor loyalty security verified xss New: affects-server cvss-high editor loyalty security verified xss
            Alex Yakovlev (Inactive) made changes -
            Labels Original: affects-server bugfix cvss-high editor security verified xss New: affects-server bugfix cvss-high editor loyalty security verified xss
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 2290400 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2394755 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2228448 ] New: Confluence Workflow - Public Facing - Restricted v5 [ 2290400 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2184708 ] New: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2228448 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 1946298 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2184708 ]

              jxie Chii (Inactive)
              b0d88db9bee7 David Corley
              Affected customers:
              0 This affects my team
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: