Executive brief
Atlassian Confluence, a popular team collaboration and documentation platform, is vulnerable to a security flaw that allows attackers to inject malicious scripts into the system. By renaming a file attachment with a specially crafted name, an attacker can cause these scripts to execute in the browsers of other users who search for or view that file. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A persistent cross-site scripting (XSS) vulnerability exists in Atlassian Confluence before version 5.10.6. The flaw is located in the 'doeditattachment.action' component, specifically within the 'newFileName' parameter. While initial file uploads may be sanitized, the application fails to properly validate or sanitize input when a user subsequently edits the properties of an existing attachment. An attacker can inject HTML or JavaScript into the filename; this payload is then executed when another user performs a search that returns the malicious attachment in the results. This vulnerability can be exploited by any user with permissions to edit attachment properties and affects all users who interact with the malicious search result. The issue was addressed in Confluence version 5.10.6.
Affected products
- Atlassian Confluence before 5.10.6
Timeline
- 2016-07-07: disclosed: Vendor acknowledged the vulnerability
- 2016-08-04: patched: Vendor released version 5.10.6
- 2017-01-18: advisory: NVD published CVE-2016-6283