atlassian confluence path traversal

In Atlassian Confluence Server the Widget Connector macro before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to gain path traversal and remote code execution on the download all attachments resource in Confluence Server or Data Center instance via server-side template injection. A remote attacker who has permission to add attachments to pages and/or blogs or to create a new space or a personal space or who has ‘Admin’ permissions for space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center.

Mitigation / Precaution

We suggest you upgrade to the latest version.

Written by

Sooraj V Nair

Cyber Security Engineer

Sooraj was probably the kid who opened up a remote control just to see what was inside, then had to figure out how to put it back together before anyone noticed. That curiosity eventually found its way into cybersecurity, where breaking things is actually part of the job description. Today, he explores vulnerabilities, analysis threats, and helps build safer digital spaces. His favourite question remains the same: “What happens if I try this?”