4 ms·

No one sane runs confluence as root. But RCE is RCE. It's always serious, even if the user isn't privileged. It's significantly easier to get root access once y

by elric 4y ago

No one sane runs confluence as root. But RCE is RCE. It's always serious, even if the user isn't privileged. It's significantly easier to get root access once you have access to an unprivileged acccount than without. And with tools like Confluence, there's a good chance that if you control the application, you can intercept login requests and steal credentials. Which can then likely help you gain access to other services.

omegalulw 4y ago
> And with tools like Confluence, there's a good chance that if you control the application, you can intercept login requests and steal credentials. I thought Atlassian products were well trusted. Is that not the case?
- rst 4y ago
  They've had a string of script-injection vulnerabilities with similar severity -- the last was less than a year ago: https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html https://confluence.atlassian.com/doc/confluence-security-adv... Each time, they patch the particular vulnerable script, but they don't seem to have done anything systematic which would eliminate the entire class of vulnerabilities (like, say, adding taint-checking for unquoted, client-supplied content before running code as an OGNL script). So they keep coming up.
- acdha 4y ago
  They’re widely used, which is not the same. If you’re a customer you’ll routinely encounter bugs, clumsy or inaccessible UI, annoying limitations, and performance issues which take ages to get fixed if ever. I would not assume that they’re better at security than everything else.
tyingq 4y ago
>No one sane runs confluence as root. See "Figure 1. Process tree in Volexity Volcano Server from the infected Confluence server" https://www.volexity.com/wp-content/uploads/2022/06/Figure1.png https://www.volexity.com/wp-content/uploads/2022/06/Figure1.... I didn't mean running as non-root would fix the problem, just that a remote root RCE was worse than a normal RCE.
emmelaich 4y ago
It would help if the run-user was not the same user that owns the files on disk. The run-user should only need to write logs and caches and databases. Not jsp files. I usually try and make this so, but it is often very hard to impossible. Vendors do not make it easy.

by elric 4y ago

omegalulw 4y ago

> And with tools like Confluence, there's a good chance that if you control the application, you can intercept login requests and steal credentials. I thought Atlassian products were well trusted. Is that not the case?

rst 4y ago
They've had a string of script-injection vulnerabilities with similar severity -- the last was less than a year ago: https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html https://confluence.atlassian.com/doc/confluence-security-adv... Each time, they patch the particular vulnerable script, but they don't seem to have done anything systematic which would eliminate the entire class of vulnerabilities (like, say, adding taint-checking for unquoted, client-supplied content before running code as an OGNL script). So they keep coming up.
acdha 4y ago
They’re widely used, which is not the same. If you’re a customer you’ll routinely encounter bugs, clumsy or inaccessible UI, annoying limitations, and performance issues which take ages to get fixed if ever. I would not assume that they’re better at security than everything else.

tyingq 4y ago

>No one sane runs confluence as root. See "Figure 1. Process tree in Volexity Volcano Server from the infected Confluence server" https://www.volexity.com/wp-content/uploads/2022/06/Figure1.png https://www.volexity.com/wp-content/uploads/2022/06/Figure1.... I didn't mean running as non-root would fix the problem, just that a remote root RCE was worse than a normal RCE.

emmelaich 4y ago

It would help if the run-user was not the same user that owns the files on disk. The run-user should only need to write logs and caches and databases. Not jsp files. I usually try and make this so, but it is often very hard to impossible. Vendors do not make it easy.