-
Bug
-
Resolution: Fixed
-
Medium
-
3.1, 3.5.13, 5.1-OD-4
-
None
-
6
-
NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report.
As discovered while looking at CONF-20667, Confluence stores the space key unencoded in a content tag. Considerable functionality relies on this content tag. Eg Doc Theme breaks without it. Themes choice breaks without it.
To exploit it, create a user with html in the login name, then create a personal space as that user. Finally, use a decorator=none request param when viewing a page to see the content tags.
There are actually a few places that the space key isn't encoded, so removing the ability to pass "decorator=none" is probably not a complete fix.
- relates to
-
-
- Closed
-
- causes
-
SCT-64 Failed to load
[CONFSERVER-20865] XSS vulnerability in space key, particularly with decorators off
This can also be an issue if the Confluence instance (or Crowd instance that Confluence delegates to) is linked with LDAP, since LDAP has next to no restrictions on the usernames it hosts. If the upstream LDAP is compromised, we don't want to allow further exploits via that either.
If you remove the ability to create xss users via RPC, you'll have to add a way in the confluence test plugin to still create xss users so we can verify that the correct url and html escaping is done. We have several (xss checking) smoke tests that rely on this feature to function.
This is only an issue if one can create "bad" usernames, which is not possible anymore.
Note that the security risk of this is actually quite low. Public signup prevents usernames containing HTML characters (angle brackets, ampersands and quotes), so you'd have to be an admin to exploit this.
I think it's a low priority security vulnerability and also a low priority bug, since it only "breaks" pages when using ?decorator=none.
yea i've since found out that locking down the rpc isn't going to work very well (and that LDAP users could just bypass it anyway).
Removed the decorator parameters instead - this will at least lessen the surface area of attack (and we have existing tests for usernames with html/xss attacks in them).