Securing Your Plugin

SECURING YOUR

PLUGIN

Penny Wyatt

Atlassian QA

Topics

Cross-Site Scripting (XSS) Vulnerabilities

Cross-Site Request Forgery (XSRF)

Vulnerabilities

Confluence WebSudo

File Execution Vulnerabilities

Random Number Vulnerabilities

Cross Site Scripting

(XSS) Vulnerabilities

XSS Vulnerabilities

Attacker runs JavaScript in the victim’s

web browser.

Attacker can do anything the victim can.

Two types:

Persisted XSS

Reflected XSS

Persisted XSS Vulnerabilities

Attacker enters malicious data which is

stored on the server.

The data are presented on a page,

unescaped.

Requires the attacker to have

permission to insert data.

Doesn’t require any action on the

victim’s part.

Reflected XSS Vulnerabilities

Attack is inserted into a URL.

Value from the querystring is reflected

directly onto the page, not stored.

Attacker gets the victim to visit the URL.

Does not require the attacker to have

any access at all.

Requires some minor social

engineering.

Fixing XSS Vulnerabilities

Where the value is inserted into plain HTML,

use HTML encoding.

JIRA - $textutils.htmlEncode($name)

Confluence - $generalUtil.htmlEncode($name)

Bamboo - ${name?html}


Where the value is inserted into JavaScript,

HTML escaping is insufficient...


JavaScript escaping is also dangerous.

Better approach – insert escaped value

into HTML and access via the DOM.


Never insert user-supplied content

directly into JavaScript.

Also includes other script execution

methods

When feasible, restrict data server-side


Only escape at the Velocity level, never

internally.

Strict boundary for safe/unsafe content.

Reduce risk of double-escaping.

Confluence Anti-XSS

Opt-in auto-escaping for Velocity

templates in Confluence.

Since Confluence 2.9.

Only partial protection.

Some areas still at risk:

HTML generated by excluded methods.

HTML generated client-side.

User-supplied variables inserted into

JavaScript.

Finding XSS Vulnerabilities

Manual code analysis

Read velocity templates, webwork,

Confluence macros, any other source of

HTML.

Trace the source of all parameters.


Manual UI testing

Enter unsafe data in all form fields, including

hidden fields.

Enter unsafe data into all URL parameters.

Watch for unexpected behaviour.


Automated Scanning tools

Burp Suite, Skipfish

Useful to catch obvious flaws.

Lots of false positives, missed

vulnerabilities.

Cross Site Request Forgery(XSRF) Vulnerabilities

XSRF Vulnerabilities

Attacker tricks victim into executing an

action.

Action can be performed merely by

visiting an URL.

Request is hidden on an unrelated page

or used in conjunction with an XSS

vulnerabilities.

Victim may be unaware of the action.


Can vote for a JIRA issue by visiting a

URL.https://extranet.atlassian.com/jira/secure/

VoteOrWatchIssue.jspa?id=19128&vote=vote

No XSRF protection in those days.

Embedded image on another page<img src=

“https://extranet.atlassian.com/jira/secure/

VoteOrWatchIssue.jspa?id=19128&vote=vote”>

Fixing XSRF Vulnerabilities

Limited-duration token issued by server.

Must provide that token when performing

protected actions.

User can manually confirm an action if

token has expired.

Since Confluence 3.0, JIRA 4.1.


Step 1 (JIRA): Add

@RequiresXsrfCheck to doExecute().


Step 1 (Confluence): Add

@RequireSecurityToken(true) to

doExecute().


Step 2: Add token to forms and querystrings.

JIRA:

Confluence:

Finding XSRF Vulnerabilities

Every action that changes the state of

the plugin or host application is

vulnerable.

Overuse of XSRF protection frustrates

users.

XSRF protection easily circumvented by

XSS.

Confluence WebSudo

Confluence WebSudo

Aka “Secure Administrator Sessions”

Second line of defence against XSS and

XSRF attacks in Confluence.

Protects administration functions by

requiring a second login into an

administrative mode.

Default 10 minute rolling timeout.

Since Confluence 3.3.

Confluence WebSudo

@WebSudoRequired annotation

Can be disabled by sysadmins

Narrows the window in which a stolen

cookie can be used to perform admin

functions, but does not eliminate it.

Disabled in dev mode.

File Execution

Vulnerabilities

File Execution

Vulnerabilities Allowing a user or administrator to

access an arbitrary location on the file

system is dangerous.

Simplest exploit – get Tomcat to serve

an uploaded file.

Escalation of privileges.

Fixing File Execution

Vulnerabilities Never allow administrators or users to

specify server file paths through the UI.

Use known safe directories.

If configuration is absolutely necessary,

store the path in a .properties file on the

server.

Random Number

Vulnerabilities


Random numbers are often used for

security, e.g.

XSRF tokens.

Reset password tokens.

If you can predict them, you can break

them.

java.util.Random is not secure.

Given one value, you can predict the

next.


java.security.SecureRandom is better

Still can be misused.

Predictable seeding (e.g. with the

system time) generates predictable

values.

Fixing Random Number

Vulnerabilities

atlassian-secure-random package.

Facade for SecureRandom that correctly

instantiates and seeds it.

Allows for future performance and

cryptographic improvements with no

future code change required.

Fixing Random Number

Vulnerabilities

Step 1: Add dependency to the pom:

Step 2: Get the instance, then use in the

same way as a SecureRandom:

Best Coding Practices

HTML-encode user values in Velocity.

Don’t insert user values into JavaScript.

XSRF-protect functions.

Use WebSudo for admin functions in

Confluence.

Restrict file system access to known

safe directories.

Use atlassian-secure-random

Securing Your Plugin

Documents

Transcript of Securing Your Plugin