Persistent cross site scripting in Confluence RefinedWiki Original Theme

SEC Consult Vulnerability Lab Security Advisory < 20141029-1 >

=======================================================================

title: Persistent cross site scripting

product: Confluence RefinedWiki Original Theme

vulnerable version: 3.x - 4.0.x

fixed version: 4.0.12

impact: high

homepage: www.refinedwiki.com

found: 2014-08-07

by: Manuel Hofer

SEC Consult Vulnerability Lab

www.sec-consult.com

=======================================================================

 

Vendor description:

-------------------

"RefinedWiki Original Theme is the perfect add-on for smarter collaboration

and documentation. It can turn Confluence into an Intranet or Extranet and

with improved organization, more intuitive navigation and customizable

designs, your whole team will love using Confluence."

 

www.refinedwiki.com/en/display/products.aspx

 

Business recommendation:

------------------------

By exploiting this vulnerability, users that are able to create or edit

content, can attack other users of confluence. An attacker might be able to

gain access to otherwise protected information in confluence.

 

It is recommended to upgrade to the latest version of RefinedWiki Original

Theme.

 

Vulnerability overview/description:

-----------------------------------

1) Persistent Cross-Site Scripting

 

The vulnerability can be used to persistently include HTML- or JavaScript

code to the "Activity Stream" of confluence. The code is executed in the

browser of users if they visit the manipulated site. The vulnerability can be

used to change the contents of the displayed site, redirect to other sites or

steal user credentials. Additionally, confluence users are potential victims

of browser exploits and JavaScript Trojans.

 

 

Proof of concept:

-----------------

1) Persistent Cross-Site Scripting

A user with the necessary permissions to create or edit content in Confluence

can exploit this vulnerability by placing the XSS payload inside the

vulnerable POST parameter "versionComment" as shown in the following request.

> POST /pages/doeditpage.action?pageId=111111 HTTP/1.1
> [...]
> atl_token=5aabd74e50724eaac8290a3447d9f6e7a179559e&originalVersion=5
> &title=Title&wysiwygContent=[REMOVED]&watchPageAfterComment=true
> &versionComment=<script>alert(document.cookie)</script>
> &notifyWatchers=true&confirm=Save&viewPermissionsUsers=
> &editPermissionsUsers=&viewPermissionsGroups=&editPermissionsGroups=
> &parentPageString=&moveHierarchy=true&position=&targetId=&draftId=0
> &entityId=9012708&newSpaceKey=tools

The submitted XSS payload gets executed every time a user visits the activity

stream of the edited page.

 

 

Vulnerable / tested versions:

-----------------------------

According to the vendor, the affected versions are RefinedWiki Original Theme

are 3.x - 4.0.x.

 

 

Vendor contact timeline:

------------------------

2014-08-08: Contacting Atlassian through issue tracking platform at

jira.atlassian.com/browse/CONF-34525

2014-08-15: Issue identified as part of the RefinedWiki Original Theme and not

Confluence itself. Atlassian forwards advisory to RefinedWiki team

2014-08-15: Vendor acknowledges the vulnerability

2014-08-18: Vendor provides fixed version

2014-08-27: Vendor releases fixed version to the public

2014-10-29: SEC Consult releases security advisory

 

 

Solution:

---------

Upgrade to the latest version available:

demo.refinedwiki.com/display/rwot/Version+4.0.12

 

Fixes are also included in version 3.5.13 and version 4.1

 

Workaround:

-----------

None

 

 

Advisory URL:

-------------

www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

 

SEC Consult

Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius - Zurich

 

Headquarter:

Mooslackengasse 17, 1190 Vienna, Austria

Phone: +43 1 8903043 0

Fax: +43 1 8903043 15

 

Mail: research at sec-consult dot com

Web: www.sec-consult.com

Blog: blog.sec-consult.com

Twitter: twitter.com/sec_consult

 

Interested to work with the experts of SEC Consult?

Write to career@sec-consult.com

 

EOF Manuel Hofer / @2014