Security Vulnerability

Question

Hello all,

We hav confluence server in the office. The version is 7.1.2. When I try to run script on the search bar it executes the script. I think this is XSS vulnerability.

Is it negligence that we forgot to install some security package. Or is it security vulnerability on Confluence?

Can someone help with this?

Thanks in advance,

Umit.

Shannon S · Answer

Hi Umit, Thank you for providing the example. It looks like you're using a theme from Scroll Viewport in order to generate that page, so it's not using the built-in Confluence search. Could you test this without the Scroll Viewport page, possibly on your staging instance, and let me know if you still have the problem within Confluence? You may need to disable any customization as well. I've tried testing this on my own Confluence Server site, but the script does not execute. Instead, a search is executed. In the case with your site, if we use Developer Tools, we can see that the search your site is calling is this: https://docs.zerodensity.tv/main/search?q=&quicksearch=true Whereas with Confluence, the search call would look like this: (QuickNav vs Full Search) http://*:8090/wiki/rest/api/search?cql=siteSearch ~ "" AND type in ("space","user","page","blogpost","attachment")&start=0&limit=20&excerpt=highlight&expand=space.icon&includeArchivedSpaces=false&src=next.ui.search http://*:8090/wiki/rest/quicknav/1/search?query=&limit=10&src=next.ui.search Let me know if you have any questions about that. Regards, Shannon

umit.unal · Answer

Hi Shannon,

Please go to docs.zerodensity.tv and find the search bar on top right.

Thanks!

Umit

Shannon S · Answer

Hi Umit,

Thank you for providing that screenshot and the example of the script.

Can you let me know what search bar that is? The Confluence search bar looks like this:

The example you sent me doesn't look familiar. Can you let me know where within Confluence I should go to replicate your issue?

By the way, this past spring, we did have a few security vulnerabilities announced in Confluence. You can find out more about that by reading Confluence CVEs and Common Questions. However, your version of 7.1.2 is new enough that you should not be affected by this.

Let me know if you have any questions!

Regards,

Shannon