Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-25541

multimedia macro allows execution of arbitrary scripts

XMLWordPrintable

      The

      {multimedia} macro in confluence embeds a swf without the 'allowScriptAccess' attribute set to 'none'. This allows the embedded (user submitted) swf to execute arbitrary javascript on the page, constituting an XSS vulnerability. The {multimedia}

      tag is bundled in with the base product and not an optional macro, so steps may need to be taken by Atlassian to fix this issue if there isn't a configuration setting anywhere.

      This issue was reported by Workday's Security Operations team member Michael Carlson

        1. HelloWorld.as
          0.3 kB
          David Corley
        2. HelloWorld.swf
          1 kB
          David Corley

            [CONFSERVER-25541] multimedia macro allows execution of arbitrary scripts

            David Black added a comment -

            CVSS score: 6.5 => High severity

            Exploitability Metrics

            AccessVector Network
            AccessComplexity Low
            Authentication Single Instance

            Impact Metrics

            ConfImpact Partial
            IntegImpact Partial
            AvailImpact Partial

            See https://extranet.atlassian.com/display/SECCOUNCIL/How+to+evaluate+vulnerability+severity+under+CVSS for details and http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2 for score calculator.

            David Black added a comment - CVSS score: 6.5 => High severity Exploitability Metrics AccessVector Network AccessComplexity Low Authentication Single Instance Impact Metrics ConfImpact Partial IntegImpact Partial AvailImpact Partial See https://extranet.atlassian.com/display/SECCOUNCIL/How+to+evaluate+vulnerability+severity+under+CVSS for details and http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2 for score calculator.

            David Black added a comment -

            Thank you for reporting this security vulnerability to Atlassian.

            David Black added a comment - Thank you for reporting this security vulnerability to Atlassian.

            David Corley added a comment -

            Attached source code for the proof (.as file).

            David Corley added a comment - Attached source code for the proof (.as file).

            David Corley added a comment -

            Attached a proof of concept that executes the javascript 'alert(document.cookie);'. Embed this in a comment or post with

            {multimedia:name=HelloWorld.swf\|autostart=true}

            .

            David Corley added a comment - Attached a proof of concept that executes the javascript 'alert(document.cookie);'. Embed this in a comment or post with {multimedia:name=HelloWorld.swf\|autostart=true} .

              jxie Chii (Inactive)
              b0d88db9bee7 David Corley
              Affected customers:
              0 This affects my team
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: