nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

EMAIL NOTIFICATION SECURITY ISSUE

Ivan Audero

Good morning,

today I stepped into a strange but huge problem.

I modified a document into confluence. This document contained an HTML table with LOTS OF PRIVATE DATA. I also configured a mail server, to send notifications about that project.

This morning, my collegue received the HTML table via mail, IN CLEAR WITHOUT REQUESTING PASSWORD. That means that if someone intercepted my message, could read the WHOLE MESSAGE WITHOUT CREDENTIALS.

Is this the default behavior? Is this, in your opinion, something acceptable in an on premise solution?

I am very disappointed, this costed me a lot of time and money to recover from this situation.

Now I have unconfigured the mail server, but what I was expecting was that if you sent a notification, you will send A SIMPLE LINK, WITH AN INTERNAL ADDRESS, WHICH WILL REQUEST USER AND PASSWORD TO SEE THE MODIFICATION! NOT A CLEAR HTML TABLE AS CONTENT OF THE EMAIL! THIS HAS NO SENSE AT ALL!

Accepted answers

All comments

Nic Brough -Adaptavist-

I am not sure why you thought you would get an email with a link, Confluence has always sent full notes on all modifications via email in line with what the documents say it will.

It's the off-the-shelf behaviour which every end user expects. I've never heard anyone else expecting anything different, you're the first I've seen have a problem with it. It is absolutely "acceptable" to do this.

If you have private data you don't want to send to people, then you need to hide it on the page - it's visible there already so an email isn't exposing anything new.

If you don't want this behaviour, consider turning off emails, at least until you have the time to go edit the templates (i.e. code) on the server that generates them.

Ivan Audero

It is not difficult to understand why.

Emails are out of the domain of Confluence. If the user with email xxx@xxx.com has access to Conflucence documents, that doesn't mean that I want to send him BY DEFAULT every modification I perform on that document IN CLEAR through email. Notifications means "hey, someone updated the document", not "here's the modification, so that everyone that intercept the message can read it".

To be strict, this isn't even a notification, it is an attachment! So, the correct way to call it is "send attachment of the document every time you modify". Absurd this is the default behaviour.

Following your ratio, there's not even need to ask login for the user: the software will send everything in clear through the internet to notificate the user of every modification!

So, the fact is:

- I bought a software on premise, in order NOT to spread my data over the network

- I configured a mail server for evenutal future tasks

- By default, you spread my data over the network

I repeat, that doesn't make any sense, even if noone ever had problems about that.

If someone hack my confluence server, of course I will lose all my data.

If someone hacks my mail (which is not even under my domain), I do not want to lose Confluence data.

Is now a bit clearer in this way?

Thiago Masutti

Hi @Ivan Audero

This is indeed a default functionality with Confluence when an SMTP server is enabled: Email Notifications.

This option is configurable for each user under their profile settings, on which you could turn it off.

There's an open feature request to make it possible to easily disable this site-wide, which is reported in CONFSERVER-43671 .

There's also a workaround to disable this functionality for all users by modifying their profile options directly in the database: How to disable Show Changed Content to all users .

Ivan Audero

Ok. Anyway, in particular with on premise solutions, this should not be default.

On premise means that I don't want my data to be outside of my company. If you send the whole document I'm modifying in the body of the email, it is pointless to have on premise architecture.

And anyway, in my opinion, if I modify a document, I DO NOT WANT to spread the modification via mail. I thought this should be default. Otherwise, if someone accidentally step into my mail, is automatically looking at Confluence private data that are protected by username and password.

I want to remark again that this behaviour (even more dangerously, by default) is absolutely out of any security logic.

By the way, now i removed the SMTP server, and probably will never activate it again because I am frightened that by default will send some confidential data over the internet.

Regards.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence