Login Vulnerability in Confluence...?

Question

Hi,

Good Day..!

This is Kevin, Actually i am here to share my login issues with confluence.

We have a LDAP system for the users management and when ever the user wants to login to the confluence it seems it was not encrypted, It takes the plane text to login. So could you please any one help me out from this and is there any chances to encrypt the user login and password in the back end..? or else any scripts..? Please help me out from this.

Thanks,

Kevin.

Ganesh_7nrl0p · Answer

Thank you Davin for your suggestion. The Vulnerability in the application is conformed by the support team, they also find the same vulnerability and the developer team is currently work on that.

Davin Studer · Answer

Well, first I would not say it is a bug. There are certain prerequisites that need to be in place in order to enable encryption. You can't just turn it on because in a lot (maybe even most) situations it would fail.

With regards to accessing Confluence over SSL you need to have an SSL cert from a Certificate Authority. You may have your own trusted cert authority in-house and might be able to issue a cert from Confluence from that. You wouldn't want to just create a cert say from OpenSSL because it probably would not be trusted by any of your web browsers unless you imported the certificate into all your machines cert store. The other option would be to get a cert from one fo the many  public CAs. Once you have that you would set up either a reverse proxy or edit the server.xml file for Confluence to enable SSL. That covers the encrypting web traffic part.

However, if you are doing LDAP for authentication then the Confluence server will talk to LDAP to verify that the credentials entered are correct. That traffic by default is not encrypted either as your LDAP server needs to support it. So, you would need to find out if it does support LDAPS connection. Then you would edir the user directory in Confluence for your LDAP server and turn on secure communication. This may or may not work right away too because if you use and in-house trusted CA you will need to import your CA certs into the java cert store located in Confluence_Install/jre/lib/security. The file is called cacerts and the password is the default used for Java installs ... "changeit".

Ganesh_7nrl0p · Answer

Actually we got the encrypted info from the security team in my organization. They find this bug in the version 6.15.9 and they clearly mentioned the data which the user entered was not encrypted.