Uploaded image for project: 'Confluence Server'
  1. Confluence Server
  2. CONFSERVER-53362

The bundled Atlassian OAuth plugin allows arbitrary HTTP requests to be proxied - CVE-2017-9506

    XMLWordPrintable

    Details

    • Symptom Severity:
      Severity 2 - Major
    • QA Demo Status:
      Not Done
    • QA Kickoff Status:
      Not Done

      Description

      The version of the bundled Atlassian OAuth plugin was vulnerable to Server Side Request Forgery (SSRF). This allowed a XSS and or a SSRF attack to be performed. More information about the Atlassian OAuth plugin issue see https://ecosystem.atlassian.net/browse/OAUTH-344 . When running in an environment like Amazon EC2, this flaw can used to access to a metadata resource that provides access credentials and other potentially confidential information.

      Workaround for Confluence - In case you can't upgrade yet to 6.1.3:

      1. Shutdown Confluence.
      2. Go to <Confluence-Installation-Directory>/confluence/WEB-INF/atlassian-bundled-plugins and find the atlassian-oauth-service-provider-plugin-2.0.2.jar file.
      3. Delete it.
      4. Download below file, which is the atlassian-oauth-service-provider-plugin-2.0.4.jar file for Confluence:
        atlassian-oauth-service-provider-plugin-2.0.4.jar
      5. Paste it inside <Confluence-Installation-Directory>/confluence/WEB-INF/atlassian-bundled-plugins folder.
      6. Clear plugin cache.
      7. Bring Confluence back online.

        Attachments

          Issue Links

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                7 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:
                  Last commented:
                  5 weeks, 6 days ago