Version: 3.0 / Current
Tested Version: 3.4.6
Vendor Notified Date: June 31, 2011
Release Date: September 19, 2012
Authentication: Depends on configuration.
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Confluence 3.0 and below allow remote attackers to submit actions on their behalf. Newer versions may also be vulnerable.
Pages that allow a potential attacker to add images (such as in the comments sections) allow CSRF. By not properly checking each URL, an attacker can execute requests on behalf of a legitimate user.
As a proof-of-concept, a comment is added to a page which includes the logout URL inside the wiki markup image tags. Whenever anyone visits that page they are automatically logged out because the page attempts to load the image and executes the ‘src=url’. This comment can be added to anyone’s profile, which would force them to be logged out the moment they login. This can be used for more complex attacks too but going beyond the POC was not necessary.
- Add comment.
Vendor Notified: Yes
Vendor Response: Requested time to resolve.
Vendor Update: 1.5 years later, marked as “Resolution: Won’t Fix”