Atlassian Companion App Zero-Day Bug Patching

Deon Meyer

Hi Atlassian Community

You all would've seen the article relating to the zero-day bug identified in the Atlassian Companion app: https://www.theregister.co.uk/2019/12/05/atlassian_zero_day_bug/

Does anybody know when we can expect the bug identified to be patched and an updated version of the Atlassian Companion App be ready for download?

Our organisation is currently using the app and although our Confluence is hosted on our intranet only, our IT Risk department still sees this as a dangerous vulnerability that needs to be addressed.

The only alternative is to discontinue the use of the app and revert to the darkfeature, to enable customers to edit their office documents. 

Shannon S

Hello @Deon Meyer,

Thank you for contacting us about this. This depends on your current Confluence version. If you are on a version prior to 6.11, then you are not affected.

For the following versions, you'd be able to switch to the original Edit in Office functionality:

• 6.13.6 - 6.13.8

• 6.15.6 - 6.15.9

• 7.1.0 and later

If you are on one of those versions, the steps to enable this feature (see Enable Edit in Office as a dark feature in Confluence) are as follows:

1. Go to <confluence-url>/admin/darkfeatures.action.
2. Add the enable.legacy.edit.in.office dark feature flag.
3. Select Submit

Do note, Edit in Office does not support the editing of all file types supported by the Companion App. Users will, however, be able to edit Microsoft Office documents. Additionally, Edit in Office will only work in the following environments:

• OS: Windows

• Browsers:

  • Chrome (only in Windows 10 and Office 2016 or later)

  • Firefox (only in versions 55.x and 56.x)

  • Internet Explorer 11

If you are not on one of the versions listed above, then you will want to disable the Companion App for now while we work on the fix.

To disable the Companion App:

1. Click Settings > Manage Apps
2. Select System from the dropdown
3. Search for Confluence Previews
4. Click the + next to 28 of 28 modules enabled 
5. Disable the following modules:
   1. ADCClient AMD Wrapper (companion-client-wrapper)
      • This is the only mandatory module to disable the Companion App. The rest remove UI elements that display 'Edit with' to avoid confusion
   2. Edit With button (companion-plugin-button)
   3. Templates for Edit With feature (companion-plugin-templates)
   4. Companion CSS resources (companion-plugin-css)
   5. Edit With plugin for the Media Viewer (companion-plugin)
   6. Embedded 'Edit With' button (embedded-edit)

Once these modules are disabled, users will no longer have the ability to start editing a Confluence attachment directly from the UI. They would need to manually download any attachments, edit them locally, and manually upload them back into Confluence via its UI.

If you have any questions about these workarounds, please let me know. 

I will follow-up with you here as soon as we have a fix released for this.

Thank you for your understanding!

Regards,

Shannon