Atlassian has confirmed a vulnerability in its Confluence team collaboration software is legitimate, which has since been resolved.
First reported by The Register, the issue was inadvertently disclosed on Twitter by SwiftOnSecurity, with a screenshot of an Atlassian domain (https://atlassian-domain-for-localhost-connections-only.com).
According to Atlassian's Confluence Support page, the domain resolves to a local server with a common SSL certificate for its Confluence cloud service, to enable Atlassian’s Companion app to edit files in a preferred local application and save files back to Confluence.
Me: Threat-hunting rare DNS lookups in a corporate network.
— SwiftOnSecurity (@SwiftOnSecurity) December 4, 2019
Confluence:https://t.co/6GPMROKua2 pic.twitter.com/pse4VwORiZ
The exposed SSL key could potentially be used by an attacker to redirect app traffic to a malicious site.
Responding to SwiftOnSecurity’s tweet, Google's Tavis Ormandy said the private key could be stolen and an attacker could resolve a domain to a different one other than “localhost”.
Yep, you can just grab the private key, and nothing is stopping you resolving this domain to something other than localhost. Therefore, no guarantee that you're talking to a trusted local service and not an attacker.
— Tavis Ormandy (@taviso) December 4, 2019
"We are aware of this issue and are actively working on it. We have requested that the certificate be revoked, and we're evaluating whether other technical solutions are required to protect our customers," an Atlassian spokesperson told CRN.
Apart from Ormandy, the tweet caught the attention of other security researchers, one of which pointed out a similarity to the server scheme that IBM's Aspera plugin client uses, “local.connectme.us”, for client-server communication.
Hm I suppose that's true then of IBM's Aspera plugin client, which uses https://t.co/kFTbQeBddh for the same kind of communication
— Tim Stone (@tmslft) December 4, 2019
Ormandy remarked that the Aspera issue could be “way, way worse”. “There's a pre-generated CA certificate and a private key, if they add that to the system store, they're effectively disabling SSL. I would consider that *critical*,” his tweet read.
-1.jpg&w=100&c=1&s=0)
.png&w=100&c=1&s=0)
