An unauthenticated attacker can generate a sizeable CPU load on a Confluence server with a single request.

2020-08-14T07:06:40
ID ATLASSIAN:CONFSERVER-60173
Type atlassian
Reporter mninnes@atlassian.com
Modified 2020-08-15T00:02:30

Description

h3. Issue Summary

Confluence has an API endpoint, which combines multiple js resources in a single response:

Example: [https://testinstance/s/c8a7f9fd0fa1b59315a49e72daea3fe1-CDN/-cqftij/8501/8467d75e6ec25a8d10de99d6fdc0db245ae130a6/64b9d10eb37a9ddd38f9fe5eb8af1bd4//download/contextbatch/js/dashboard,backbone-dashboard,atl.general,-_super/batch.js?healthcheck-resources=true&hostenabled=true&locale=ru-RU&user-logged-in=true|https://mockrun-confluence.stg-myteksi.com/s/c8a7f9fd0fa1b59315a49e72daea3fe1-CDN/-cqftij/8501/8467d75e6ec25a8d10de99d6fdc0db245ae130a6/64b9d10eb37a9ddd38f9fe5eb8af1bd4//download/contextbatch/js/dashboard,backbone-dashboard,atl.general,-_super/batch.js?healthcheck-resources=true&hostenabled=true&locale=ru-RU&user-logged-in=true]

The same request can be simplified to:

[https://testinstance/s/1/1/1/1/1//download/contextbatch/js/dashboard,backbone-dashboard,atl.general,-_super/batch.js|https://mockrun-confluence.stg-myteksi.com/s/1/1/1/1/1//download/contextbatch/js/dashboard,backbone-dashboard,atl.general,-_super/batch.js]

This request will return the corresponding javascript for the dashboard, backbone-dashboard, and atl.general. At the same time, it will remove some Javascript due to  {{-_super}}.

At the same time, the endpoint checks that there are no repeating javascript resources in the response and performs some form of deduplication or other computationally expensive task.

It's possible to streamline such an approach and easily generate load because: * It's not necessary to download the API response. HEAD requests to this API also work the same. * It is not necessary to keep TCP connection active and wait for any response

h3. Steps to Reproduce # Request a URL like: {code:java} curl https://testinstance/s/1/1/1/1/1/_/download/contextbatch/js/confluence.extra.jira:common,confluence.web.components:core,confluence.web.resources:quicksearchdropdown,confluence.web.resources:shared-templates,confluence.web.resources:contentnamesearch,confluence.web.components:dom-filter-field,confluence.web.components:property-panel,com.atlassian.confluence.plugins.confluence-user-profile:avatar-picker,com.atlassian.plugins.base-hipchat-integration-plugin:invites-soy-resources,com.atlassian.confluence.plugins.confluence-page-banner:soy-resources,com.atlassian.diagnostics.atlassian-diagnostics-plugin:interval-filter,com.atlassian.confluence.plugins.confluence-ui-components:cql,com.atlassian.integration.jira.jira-integration-plugin:fields,com.atlassian.confluence.plugins.confluence-hipchat-integration-plugin:hipchat-soy-resources,com.atlassian.confluence.plugins.confluence-space-ia:soy-resources,com.atlassian.gadgets.directory:gadget-directory-admin-client,com.atlassian.confluence.plugins.quickedit:quick-comment-page,confluence.web.resources:breadcrumbs,com.atlassian.plugins.atlassian-nav-links-plugin:rotp-menu,com.atlassian.applinks.applinks-plugin:applinks-new-ui-creation,com.atlassian.upm.atlassian-universal-plugin-manager-plugin:upm-marketplace-resources,confluence.web.resources:attachments,com.atlassian.confluence.plugins.confluence-create-content-plugin:resources,com.atlassian.auiplugin:aui-experimental-restfultable,com.atlassian.auiplugin:aui-restfultable,com.atlassian.confluence.plugins.quickreload:quick-reload-resources,com.atlassian.confluence.plugins.confluence-create-content-plugin:space-blueprints,com.atlassian.confluence.plugins.drag-and-drop:support,confluence.web.resources:aui-experimental,com.atlassian.applinks.applinks-plugin:applinks-new-ui,com.atlassian.applinks.applinks-plugin:applinks-v2-shim,com.atlassian.confluence.plugins.reliablesave:reliable-save-conf-frontend,com.atlassian.auiplugin:jquery-ui-other,com.atlassian.confluence.plugins.confluence-browser-metrics:spa-navigation,com.atlassian.confluence.plugins.confluence-browser-metrics:spa-transitions,com.atlassian.integration.jira.jira-integration-plugin:jira-create-issue-form,com.atlassian.confluence.plugins.reliablesave:reliable-save,com.atlassian.confluence.plugins.confluence-inline-tasks:tasks-report-resources,com.atlassian.confluence.plugins.quickedit:quick-comment-initial,com.atlassian.integration.jira.jira-integration-plugin:transition-form,com.atlassian.applinks.applinks-plugin:feature-bitbucket-rebrand,com.atlassian.upm.atlassian-universal-plugin-manager-plugin:upm-manage-plugins-resources,com.atlassian.confluence.plugins.confluence-previews:companion-plugin-button,com.atlassian.confluence.plugins.confluence-inline-comments:editor,com.atlassian.plugins.base-hipchat-integration-plugin:invites-resources,com.atlassian.confluence.plugins.drag-and-drop:drag-and-drop-for-view-attachments,com.atlassian.confluence.plugins.drag-and-drop:drop-zone-for-image-dialog-conf-frontend,com.atlassian.confluence.plugins.confluence-hipchat-integration-plugin:hipchat-resources,com.atlassian.confluence.plugins.drag-and-drop:drag-and-drop-for-editor-common,com.atlassian.confluence.plugins.confluence-onboarding:onboarding-common-resources,com.atlassian.cluster.monitoring.cluster-monitoring-plugin:lib,com.atlassian.confluence.plugins.confluence-inline-comments:create-comment-view,com.atlassian.confluence.plugins.confluence-inline-comments:display-reply-view,com.atlassian.confluence.plugins.confluence-inline-comments:reply-list-view,com.atlassian.applinks.applinks-plugin:feature-applink-status,com.atlassian.applinks.applinks-plugin:list-application-links,com.atlassian.confluence.plugins.confluence-roadmap-plugin:roadmap-editor-view-resources,com.atlassian.confluence.plugins.confluence-inline-comments:display-comment-view,com.atlassian.confluence.plugins.confluence-inline-comments:sidebar-view,com.atlassian.confluence.plugins.confluence-inline-comments:resolved-comment-view,com.atlassian.confluence.editor:panel-components,com.atlassian.applinks.applinks-plugin:feature-v3-list,com.atlassian.confluence.plugins.confluence-previews:mediaviewer-core,com.atlassian.confluence.editor:atlassian-editor-rte-resources,com.atlassian.confluence.plugins.confluence-inline-tasks:confluence-inlineTasks-utils,com.atlassian.integration.jira.jira-integration-plugin:jira-issues-dialog,com.atlassian.confluence.plugins.confluence-macro-browser:macro-browser-js,com.atlassian.confluence.plugins.confluence-macro-browser:macro-browser-resources,com.atlassian.confluence.plugins.confluence-dashboard:confluence-dashboard-resources,com.atlassian.whisper.atlassian-whisper-plugin:atlassian-whisper-hermes,com.atlassian.confluence.editor:editor-javascript-resources,com.atlassian.plugins.editor:atlassian-rte-resources,com.atlassian.confluence.editor:page-editor-js,com.atlassian.confluence.editor:page-editor,confluence.editor.actions:editor-macro-browser,confluence.web.resources:page-editor,com.atlassian.confluence.plugins.confluence-image-attributes:image-attributes,com.atlassian.confluence.plugins.confluence-inline-tasks:date-helper-js-resources,com.atlassian.confluence.plugins.confluence-page-layout:pagelayout-frontend,com.atlassian.confluence.plugins.confluence-previews:confluence-previews-js,com.atlassian.confluence.plugins.confluence-previews:confluence-previews-resources,com.atlassian.confluence.plugins.confluence-editor-v4:editor-resources-v4,com.atlassian.confluence.editor:bookmark-manager-conf-frontend,com.atlassian.confluence.plugins.confluence-previews:upload-plugin,com.atlassian.confluence.plugins.confluence-previews:companion-plugin,com.atlassian.confluence.plugins.confluence-previews:version-navigation-plugin,com.atlassian.confluence.plugins.confluence-previews:annotation-plugin,com.atlassian.confluence.editor:editor-resources,com.atlassian.confluence.editor:editor-resources-v3,com.atlassian.confluence.tinymceplugin:editor-resources,confluence.extra.jira:jiraAnalytics,com.atlassian.confluence.plugins.confluence-paste:autoconvert-core,com.atlassian.confluence.editor:editor-autocomplete-base,com.atlassian.confluence.editor:editor-autocomplete-macro,com.atlassian.confluence.editor:editor-search-replace,com.atlassian.confluence.editor:editor-autocomplete-links-media,com.atlassian.confluence.editor:editor-autocomplete-resources,com.atlassian.confluence.editor:editor-autocomplete-resources-only,com.atlassian.confluence.tinymceplugin:editor-autocomplete-resources,com.atlassian.confluence.plugins.confluence-link-browser:link-browser-resources,main,_super,setup,atl.general/batch.js{code} # Repeat the call and append any new nonexistent resource to the query to trigger a cache miss. Repeated requests against the same URL with new random parameters will consume several seconds of CPU time.

h3. Expected Results

Confluence should not become unusable from repeated non-genuine requests such as these. h3. Actual Results

Requesting this URL will return a file which is ~6 Mb in size. On a multicore system it can take several seconds to TTFB and will produce CPU load on the JVM.  h3. Workaround

Currently there is no known workaround for this behaviour. A workaround will be added here when available