6 ms·

An Atlassian Confluence vulnerability is being exploited in the wild

62 points by RadixDLT 3y ago

avgcorrection 3y ago
I'm gonna assume that Confluence cloud is unaffected since it isn't mentioned.
- dotty- 3y ago
  Atlassian mentions in their original advisory[0] that Cloud is not vulnerable. But Atlassian usually just... leaves it at that. No clarification on if Cloud was ever vulnerable in the past or whether there was any evidence of exploitation attempts on Cloud customers. Something I wish they would provide more details on as my company is also an Atlassian customer. [0]: https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html https://confluence.atlassian.com/security/cve-2023-22515-pri...
  - sullivanmatt 3y ago
    In all of these advisories there has never once been a mention of cloud being vulnerable. I think it's safe to assume cloud runs a similar, if not identical, codebase, and that these issues are simply patched there first before vulnerability announcements are published. But that's the type of thing no company is ever going to be willing to say in public.
    - mschuster91 3y ago
      Someone in here claimed recently that the Cloud products were forked many years ago, which sounds believable - there's tons of little stuff that only works on either Cloud or on-prem.
- skipper-roo 3y ago
  They never seem to publish security vulnerabilities related to their cloud except in aggregate so who knows.
xahrepap 3y ago
From: https://nvd.nist.gov/vuln/detail/CVE-2023-22515 https://nvd.nist.gov/vuln/detail/CVE-2023-22515 > Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
- j45 3y ago
  This is a great time for Atlassian to be revoking self-hosting for the masses. The cloud is someone else's computer, not secured how you might, and not out of the way.
  - j45 3y ago
    Downvoting is fine, comments are even more welcome.
    - phero_cnstrcts 3y ago
      Could be a move by atlasian to get everybody on cloud.
      - j45 3y ago
        I don’t think the Atlassian cloud is very good or fast. Self hosted instances have always been much faster
  - CHSbeachbum420 3y ago
    Do you work for a cloud provider? Self hosting is superior
    - j45 3y ago
      I do not work for a cloud at all and prefer self hosting myself. I guess I could see my comment being taken otherwise.
Eumenes 3y ago
Does confluence still require you to manually increase jvm memory so it won't crash?
- severino 3y ago
  You mean confluence won't run in your jvm with a default 128mb heap? Then I guess so, I'm not aware of any way a java application can automatically increase the heap size of the vm it's running in.
  - gizmo686 3y ago
    Its pretty common for Java applications to ship with a wrapper that spawns the JVM with whatever parameters it needs.
skipper-roo 3y ago
What is atlassian doing? Last year it was the RCE CVE-2022-26134. And now this. Getting published by CISA every year isn't a good look.
- deleted 3y ago
  [deleted]
- RomanPushkin 3y ago
  We once had a meeting with our ex-CTO. The question was how do you envision the technical future of Atlassian. The most popular tag was "fire", referring to the "Five-alarm fire" program they introduced to fight a series or emerging outages. This program was over at the time when we had this poll. Seems like everyone in the org saw that in 2021. Later it was confirmed multiple times, with one of the services down for almost a week for some clients, and TBH with other outages. And in 2021 the CTO just ignored the most popular "fire" answer saying something "while we're getting votes coming in, let's talk about..." They replaced CTO, but it didn't help. At this point I'm pretty confident it's about founders who cannot keep it under control. So you know, this org is 70-80% KTLO.
  - talent_deprived 3y ago
    IDK, I've used Jira and Confluence at almost every place I've worked the past 20 years, love those tools.
    - RomanPushkin 3y ago
      There is pretty substantial number of folks who hate Jira, TBH. But you're the reason is their stock is still flat, and the entire company worth something.
      - sofixa 3y ago
        They probably don't hate Jira, but specific implementations of it, which can easily turn to shit with bad management because the tool is flexible enough to allow it.
tedunangst 3y ago
Are there bugs the FBI tells you not to patch?
- Novosell 3y ago
  No(I think), but I imagine they don't comment at all about most bugs.

62 points by RadixDLT 3y ago

avgcorrection 3y ago

I'm gonna assume that Confluence cloud is unaffected since it isn't mentioned.

dotty- 3y ago
Atlassian mentions in their original advisory[0] that Cloud is not vulnerable. But Atlassian usually just... leaves it at that. No clarification on if Cloud was ever vulnerable in the past or whether there was any evidence of exploitation attempts on Cloud customers. Something I wish they would provide more details on as my company is also an Atlassian customer. [0]: https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html https://confluence.atlassian.com/security/cve-2023-22515-pri...
- sullivanmatt 3y ago
  In all of these advisories there has never once been a mention of cloud being vulnerable. I think it's safe to assume cloud runs a similar, if not identical, codebase, and that these issues are simply patched there first before vulnerability announcements are published. But that's the type of thing no company is ever going to be willing to say in public.
  - mschuster91 3y ago
    Someone in here claimed recently that the Cloud products were forked many years ago, which sounds believable - there's tons of little stuff that only works on either Cloud or on-prem.
skipper-roo 3y ago
They never seem to publish security vulnerabilities related to their cloud except in aggregate so who knows.

xahrepap 3y ago

From: https://nvd.nist.gov/vuln/detail/CVE-2023-22515 https://nvd.nist.gov/vuln/detail/CVE-2023-22515 > Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

j45 3y ago
This is a great time for Atlassian to be revoking self-hosting for the masses. The cloud is someone else's computer, not secured how you might, and not out of the way.
- j45 3y ago
  Downvoting is fine, comments are even more welcome.
  - phero_cnstrcts 3y ago
    Could be a move by atlasian to get everybody on cloud.
    - j45 3y ago
      I don’t think the Atlassian cloud is very good or fast. Self hosted instances have always been much faster
- CHSbeachbum420 3y ago
  Do you work for a cloud provider? Self hosting is superior
  - j45 3y ago
    I do not work for a cloud at all and prefer self hosting myself. I guess I could see my comment being taken otherwise.

Eumenes 3y ago

Does confluence still require you to manually increase jvm memory so it won't crash?

severino 3y ago
You mean confluence won't run in your jvm with a default 128mb heap? Then I guess so, I'm not aware of any way a java application can automatically increase the heap size of the vm it's running in.
- gizmo686 3y ago
  Its pretty common for Java applications to ship with a wrapper that spawns the JVM with whatever parameters it needs.

skipper-roo 3y ago

What is atlassian doing? Last year it was the RCE CVE-2022-26134. And now this. Getting published by CISA every year isn't a good look.

deleted 3y ago
[deleted]
RomanPushkin 3y ago
We once had a meeting with our ex-CTO. The question was how do you envision the technical future of Atlassian. The most popular tag was "fire", referring to the "Five-alarm fire" program they introduced to fight a series or emerging outages. This program was over at the time when we had this poll. Seems like everyone in the org saw that in 2021. Later it was confirmed multiple times, with one of the services down for almost a week for some clients, and TBH with other outages. And in 2021 the CTO just ignored the most popular "fire" answer saying something "while we're getting votes coming in, let's talk about..." They replaced CTO, but it didn't help. At this point I'm pretty confident it's about founders who cannot keep it under control. So you know, this org is 70-80% KTLO.
- talent_deprived 3y ago
  IDK, I've used Jira and Confluence at almost every place I've worked the past 20 years, love those tools.
  - RomanPushkin 3y ago
    There is pretty substantial number of folks who hate Jira, TBH. But you're the reason is their stock is still flat, and the entire company worth something.
    - sofixa 3y ago
      They probably don't hate Jira, but specific implementations of it, which can easily turn to shit with bad management because the tool is flexible enough to allow it.

tedunangst 3y ago

Are there bugs the FBI tells you not to patch?

Novosell 3y ago
No(I think), but I imagine they don't comment at all about most bugs.