Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-20865

XSS vulnerability in space key, particularly with decorators off

XMLWordPrintable

      NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report.

      As discovered while looking at CONF-20667, Confluence stores the space key unencoded in a content tag. Considerable functionality relies on this content tag. Eg Doc Theme breaks without it. Themes choice breaks without it.

      To exploit it, create a user with html in the login name, then create a personal space as that user. Finally, use a decorator=none request param when viewing a page to see the content tags.

      There are actually a few places that the space key isn't encoded, so removing the ability to pass "decorator=none" is probably not a complete fix.

            [CONFSERVER-20865] XSS vulnerability in space key, particularly with decorators off

            set-jac-bot made changes -
            Link New: This issue details CONFSERVER-21012 [ CONFSERVER-21012 ]
            Katherine Yabut made changes -
            Workflow Original: JAC Bug Workflow v3 [ 2879470 ] New: CONFSERVER Bug Workflow v4 [ 3003235 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow v2 [ 2784509 ] New: JAC Bug Workflow v3 [ 2879470 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow [ 2713617 ] New: JAC Bug Workflow v2 [ 2784509 ]
            Owen made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2400081 ] New: JAC Bug Workflow [ 2713617 ]
            Niraj Bhawnani made changes -
            Link New: This issue is duplicated by CONFSERVER-29339 [ CONFSERVER-29339 ]
            Alex Yakovlev (Inactive) made changes -
            Labels Original: affects-cloud affects-server bf_triage bugfix cvss-high loyalty security spaces verified New: affects-cloud affects-server bf_triage cvss-high loyalty security spaces verified
            Alex Yakovlev (Inactive) made changes -
            Labels Original: affects-cloud affects-server bf_triage bugfix cvss-high security spaces verified New: affects-cloud affects-server bf_triage bugfix cvss-high loyalty security spaces verified
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 2299286 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2400081 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2233818 ] New: Confluence Workflow - Public Facing - Restricted v5 [ 2299286 ]

              jxie Chii (Inactive)
              don.willis@atlassian.com Don Willis
              Affected customers:
              0 This affects my team
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: