1300 431 733CONTACT US

29

Aug

2019

Are you using Confluence DC? Read this important security warning

by GLiNTECH

Atlassian have recently announced a security vulnerability that affects Confluence Server and Data Center products. If you use this product, see below for steps to address this vulnerability.

Summary of Vulnerability

Atlassian disclosed a critical severity security vulnerability which affect all versions of Confluence Server and Confluence Data Center from:

  • 6.1.0 before 6.6.16 (the fixed version for 6.6.x)
  • from 6.7.0 before 6.13.7 (the fixed version for 6.13.x)
  • from 6.14.0 before 6.15.8 (the fixed version for 6.15.x) are affected by this vulnerability.

Atlassian recommends that you upgrade to the latest version (6.15.8).

Note that Atlassian Cloud instances are not affected by the issue described in this announcement. Customers who have upgraded Confluence Server or Confluence Data Center to version 6.6.16, 6.13.7 or 6.15.8 are not affected.



Severity

Atlassian rates the severity level of this vulnerability as critical, according to the scale published at Atlassian severity levels.

This is their assessment and you should evaluate its applicability to your own IT environment.


Description of vulnerability

Confluence Server and Data Center had a local file disclosure vulnerability in the page export function. A remote attacker who has Add Page space permission would be able to read arbitrary files in the <install-directory>/confluence/WEB-INF directory, which may contain configuration files used for integrating with other services, potentially leaking credentials, such as LDAP credentials, or other sensitive information. The potential to leak LDAP credentials exists if LDAP credentials are specified in an atlassian-user.xml file, which is a deprecated method for configuring LDAP integration.

To determine the impact of this vulnerability, please check your <install-directory>/confluence/WEB-INF directory and its subdirectories (especially /classes/) for any files that contain LDAP or Crowd credentials (crowd.properties, atlassian-user.xml), or files that contain any other sensitive data that an administrator may have put in this directory. If nothing is found, this vulnerability is not immediately exploitable. 

If credentials are found in these directories, you should cycle the passwords.


Advice to resolve this issue

Upgrade Confluence

Atlassian recommends that you upgrade to the latest version (6.15.8). For a full description of the latest version of Confluence Server or Confluence Data Center, see the 6.15.8 Release Notes. You can download the latest version of Confluence Server or Confluence Data Center from the Atlassian website and find our Confluence installation and upgrade guide here.

If you cannot upgrade Confluence Server or Confluence Data Center to version 6.15.8 or higher:

(1) If you have a current enterprise release version (an enterprise release version released on 28th August 2017 or later), upgrade to the latest version of your enterprise release version.

If you have enterprise release version...

then upgrade to version:

6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 6.6.13, 6.6.14, 6.6.15

6.6.16

6.13.0, 6.13.1, 6.13.2, 6.13.3, 6.13.4, 6.13.5, 6.13.6

6.13.7


(2) If you have an older version (a feature version released before 28th February 2019, or an enterprise release version released before 28th August 2017), either upgrade to the latest version of Confluence Server or Data Center, or to the latest version of an enterprise release version.

If you are running Confluence 6.10 because you are unable to upgrade to a later version due to compatibility issues with Companion App (which replaced Edit in Office), upgrade to either 6.15.8 or 6.13.7(Enterprise Release) and follow the steps in our documentation to enable the legacy Edit in Office feature.


Temporary fix if upgrading is not immediately possible

If you are unable to upgrade Confluence immediately or are in the process of migrating to Confluence Cloud, then as a temporary workaround you can use the atlassian.confluence.export.word.max.embedded.images system property to set the maximum number of images to include in Word exports to zero. This will prevent images from being embedded in Word exports.

How you apply the system property depends on how you run Confluence.

Run Confluence as a Windows service. Click this link to expand.

  1. In Windows, go to Services and locate your Confluence service. It will be called something like "Atlassian Confluence Confluence12345678"
  2. Double click the Confluence service, and make a note of the Service name. It will be something like "Confluence12345678".
  3. Open Command Prompt and cd to the <install-directory>\bin directory
  4. Run the following command, where "SERVICENAME" is your service name.tomcat9w //ES//SERVICENAMENote that the Tomcat version may be different in your version of Confluence. You can check the name of your Tomcat file in the <install-directory>/bin (it will be either tomcat8w.exe, or tomcat9w.exe)

  5. The Services dialog will appear, this time with a Java tab. 
  6. In the Java Options field, add the following on a new line:


Start Confluence on Windows manually. Click this link to expand.

  1. Stop Confluence.
  2. Edit the <install-directory>\bin\setenv.bat file.
  3. In the block the configures the CATALINA_OPTS variable, add the following line:

    set CATALINA_OPTS=-Datlassian.confluence.export.word.max.embedded.images=0 %CATALINA_OPTS%
  4. Save the file and restart Confluence.


Start Confluence on Linux manually. Click this link to expand.

  1. Stop Confluence.
  2. Edit the <install-directory>/bin/setenv.sh file.
  3. In the block the configures the CATALINA_OPTS variable, add the following line:

    CATALINA_OPTS="-Datlassian.confluence.export.word.max.embedded.images=0 ${CATALINA_OPTS}"
  4. Save the file and restart Confluence.

Speak to an Atlassian Expert today