lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 29 Oct 2014 14:11:04 +0100
From: SEC Consult Vulnerability Lab <>
To: <>, <>
Subject: [FD] SEC Consult SA-20141029-1 :: Persistent cross site scripting
 in Confluence RefinedWiki Original Theme

SEC Consult Vulnerability Lab Security Advisory < 20141029-1 >
              title: Persistent cross site scripting
            product: Confluence RefinedWiki Original Theme
 vulnerable version: 3.x - 4.0.x
      fixed version: 4.0.12
             impact: high
              found: 2014-08-07
                 by: Manuel Hofer
                     SEC Consult Vulnerability Lab

Vendor description:
"RefinedWiki Original Theme is the perfect add-on for smarter collaboration
and documentation. It can turn Confluence into an Intranet or Extranet and
with improved organization, more intuitive navigation and customizable
designs, your whole team will love using Confluence."

Business recommendation:
By exploiting this vulnerability, users that are able to create or edit
content, can attack other users of confluence. An attacker might be able to
gain access to otherwise protected information in confluence.

It is recommended to upgrade to the latest version of RefinedWiki Original

Vulnerability overview/description:
1) Persistent Cross-Site Scripting

The vulnerability can be used to persistently include HTML- or JavaScript
code to the "Activity Stream" of confluence. The code is executed in the
browser of users if they visit the manipulated site. The vulnerability can be
used to change the contents of the displayed site, redirect to other sites or
steal user credentials. Additionally, confluence users are potential victims
of browser exploits and JavaScript Trojans.

Proof of concept:
1) Persistent Cross-Site Scripting
A user with the necessary permissions to create or edit content in Confluence
can exploit this vulnerability by placing the XSS payload inside the
vulnerable POST parameter "versionComment" as shown in the following request.

> POST /pages/doeditpage.action?pageId=111111 HTTP/1.1
> [...]
> atl_token=5aabd74e50724eaac8290a3447d9f6e7a179559e&originalVersion=5
> &title=Title&wysiwygContent=[REMOVED]&watchPageAfterComment=true
> &versionComment=<script>alert(document.cookie)</script>
> &notifyWatchers=true&confirm=Save&viewPermissionsUsers=
> &editPermissionsUsers=&viewPermissionsGroups=&editPermissionsGroups=
> &parentPageString=&moveHierarchy=true&position=&targetId=&draftId=0
> &entityId=9012708&newSpaceKey=tools

The submitted XSS payload gets executed every time a user visits the activity
stream of the edited page.

Vulnerable / tested versions:
According to the vendor, the affected versions are RefinedWiki Original Theme
are 3.x - 4.0.x.

Vendor contact timeline:
2014-08-08: Contacting Atlassian through issue tracking platform at
2014-08-15: Issue identified as part of the RefinedWiki Original Theme and not
            Confluence itself. Atlassian forwards advisory to RefinedWiki team
2014-08-15: Vendor acknowledges the vulnerability
2014-08-18: Vendor provides fixed version
2014-08-27: Vendor releases fixed version to the public
2014-10-29: SEC Consult releases security advisory

Upgrade to the latest version available:

Fixes are also included in version 3.5.13 and version 4.1


Advisory URL:

SEC Consult Vulnerability Lab

SEC Consult
Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius - Zurich

Mooslackengasse 17, 1190 Vienna, Austria
Phone:   +43 1 8903043 0
Fax:     +43 1 8903043 15

Mail: research at sec-consult dot com

Interested to work with the experts of SEC Consult?
Write to

EOF Manuel Hofer / @2014

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists