Lucene search

K
atlassianD7eb00dac63fCONFSERVER-91699
HistorySep 25, 2023 - 5:35 p.m.

User with system administrator privilege can search restricted pages.

2023-09-2517:35:34
d7eb00dac63f
jira.atlassian.com
4
confluence
privilege
escalation
vulnerability
search
restriction
system administrator
global permissions
anonymous access
confluence-administrators
confluence-users
error
restricted page
workaround

h3. Issue Summary

Starting Confluence 8.5.1 when a user is granted System administrator permission at Global permissions. The user can search for Restricted content and the restricted page gets displayed in search, when tried to access it says “Page can’t be found”.

This behaviour is not reproducible in: 7.19.11 and 8.4.1.
h3. Steps to Reproduce

Make sure the anonymous access is disabled.

Only the confluence-administrators group has access to the space.

Login as admin user(who is part of confluence-administrators group)

create a few pages.

create user: test

Add him to only the confluence-users group.

Search for the content created by admin user. Search does not display the pages.

Go to Global Permissions >> Add System administrator permission to test user.

Search for the content owned by admin user, the page is displayed in the search for test user.

Try to access it, It will display: “{}Page not found{}” error.

Attached the screen record demonstrating the behaviour.

h3. Expected Results

The search should not display restricted pages. Also, when trying to access a restricted page it should display a “{}Not Permitted error{}” or “{}Restricted page{}” message and provide the option to request access. 
h3. Actual Results

Search displays “Restricted” pages. When tried to access gives “{}Page not found{}” error. 
h3. Workaround

Currently, there is no known workaround for this behavior. A workaround will be added here when available

Affected configurations

Vulners
Node
atlassianconfluence_data_centerRange8.5.1
OR
atlassianconfluence_data_centerRange8.5.2
OR
atlassianconfluence_data_centerRange8.5.5