Confluence RefinedWiki Original Theme Cross Site Scripting

`SEC Consult Vulnerability Lab Security Advisory < 20141029-1 >  
=======================================================================  
title: Persistent cross site scripting  
product: Confluence RefinedWiki Original Theme  
vulnerable version: 3.x - 4.0.x  
fixed version: 4.0.12  
impact: high  
homepage: http://www.refinedwiki.com/  
found: 2014-08-07  
by: Manuel Hofer  
SEC Consult Vulnerability Lab  
https://www.sec-consult.com  
=======================================================================  
  
Vendor description:  
-------------------  
"RefinedWiki Original Theme is the perfect add-on for smarter collaboration  
and documentation. It can turn Confluence into an Intranet or Extranet and  
with improved organization, more intuitive navigation and customizable  
designs, your whole team will love using Confluence."  
  
http://www.refinedwiki.com/en/display/products.aspx  
  
Business recommendation:  
------------------------  
By exploiting this vulnerability, users that are able to create or edit  
content, can attack other users of confluence. An attacker might be able to  
gain access to otherwise protected information in confluence.  
  
It is recommended to upgrade to the latest version of RefinedWiki Original  
Theme.  
  
Vulnerability overview/description:  
-----------------------------------  
1) Persistent Cross-Site Scripting  
  
The vulnerability can be used to persistently include HTML- or JavaScript  
code to the "Activity Stream" of confluence. The code is executed in the  
browser of users if they visit the manipulated site. The vulnerability can be  
used to change the contents of the displayed site, redirect to other sites or  
steal user credentials. Additionally, confluence users are potential victims  
of browser exploits and JavaScript Trojans.  
  
  
Proof of concept:  
-----------------  
1) Persistent Cross-Site Scripting  
A user with the necessary permissions to create or edit content in Confluence  
can exploit this vulnerability by placing the XSS payload inside the  
vulnerable POST parameter "versionComment" as shown in the following request.  
  
> POST /pages/doeditpage.action?pageId=111111 HTTP/1.1  
> [...]  
> atl_token=5aabd74e50724eaac8290a3447d9f6e7a179559e&originalVersion=5  
> &title=Title&wysiwygContent=[REMOVED]&watchPageAfterComment=true  
> &versionComment=<script>alert(document.cookie)</script>  
> &notifyWatchers=true&confirm=Save&viewPermissionsUsers=  
> &editPermissionsUsers=&viewPermissionsGroups=&editPermissionsGroups=  
> &parentPageString=&moveHierarchy=true&position=&targetId=&draftId=0  
> &entityId=9012708&newSpaceKey=tools  
  
The submitted XSS payload gets executed every time a user visits the activity  
stream of the edited page.  
  
  
Vulnerable / tested versions:  
-----------------------------  
According to the vendor, the affected versions are RefinedWiki Original Theme  
are 3.x - 4.0.x.  
  
  
Vendor contact timeline:  
------------------------  
2014-08-08: Contacting Atlassian through issue tracking platform at  
https://jira.atlassian.com/browse/CONF-34525  
2014-08-15: Issue identified as part of the RefinedWiki Original Theme and not  
Confluence itself. Atlassian forwards advisory to RefinedWiki team  
2014-08-15: Vendor acknowledges the vulnerability  
2014-08-18: Vendor provides fixed version  
2014-08-27: Vendor releases fixed version to the public  
2014-10-29: SEC Consult releases security advisory  
  
  
Solution:  
---------  
Upgrade to the latest version available:  
http://demo.refinedwiki.com/display/rwot/Version+4.0.12  
  
Fixes are also included in version 3.5.13 and version 4.1  
  
Workaround:  
-----------  
-  
  
  
Advisory URL:  
-------------  
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm  
  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
SEC Consult Vulnerability Lab  
  
SEC Consult  
Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius - Zurich  
  
Headquarter:  
Mooslackengasse 17, 1190 Vienna, Austria  
Phone: +43 1 8903043 0  
Fax: +43 1 8903043 15  
  
Mail: research at sec-consult dot com  
Web: https://www.sec-consult.com  
Blog: http://blog.sec-consult.com  
Twitter: https://twitter.com/sec_consult  
  
Interested to work with the experts of SEC Consult?  
Write to [email protected]  
  
EOF Manuel Hofer / @2014  
  
`