Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

zdnet.com

Post reply on HN
Print view View original

21–30 of 344 posts

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#21

Post by mrweasel »

winkelwagen wrote: post #12
m_eiman wrote: post #6

Earlier quoted context omitted.

Any suggestions on what to use instead of Confluence? Need to run on-prem, it's mostly the wiki-like features I'm interested in.

What target group? Devs? Po? General org?

I'll just go with "Yes" because we use the same Confluence installation our entire organisation. Spaces might be configured differently, but we can have all our documentation in one system and link across space.

There really isn't that many alternatives, SharePoint maybe, but then you're just suggestion something worse.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#22

Post by ashtonkem »

spuz wrote: post #19

The linked proof-of-concept [1] demonstrates bypassing the OGNL blacklist by using this to do reflection: > ""["class"].forName(...) as opposed to: > "".getClass().forName(...) Does anyone know why this works in OGNL? It does not appear to be valid Java syntax. [1] https://github.com/httpvoid/writeups/blob/main/Confluence-RC... Edit: Oh apparently, it's just a feature of OGNL: https://commons.apache.org/proper/common…

Never used it, but a quick perusal of its Wikipedia article mentions that it was a rewrite of something else using ANTLR, which implies a separate syntax.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#23

Post by miken123 »

Atlassian was so kind to update their mailing lists somewhere over the last year or so. Previously, they would email the 'technical contact' of the license about any vulnerabilities. They quietly switched to some other notification system and never informed us about it. Hence we missed the update and got a free Bitcoin miner. Thanks Atlassian, I'll make sure to get your products out of the door as soon as possible.

[edit] Oh it's even better. Their site says 'Note: if you are a tech administrator, you will always receive these notifications.' but they never mailed us. Great job, Atlassian, great job.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#25

Post by polote »

That's one of the selling point of Saas compared to hosted instance honestly. Some company think that having Confluence hosted internally is going to increase the security. But this is wrong. When you rely on a Saas provider. The provider has people who monitor the infrastructure constantly whereas when you hosted on your own server, the confluence instance is just one of the many services that they manage. And even if some company will be very reactive to events like this. The majority of companies will be much slower.

And in addition to that. When you use Saas. Security is a top priority, a Saas provider can't allow to have data of its customers leaked on the web. Whereas once again when it is internal data people will be less cautious

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#26

Post by raesene9 »

CodeGlitch wrote: post #9
Closi wrote: post #7

Earlier quoted context omitted.

So that users can be at home or on a mobile device without requiring them to have VPN. But so that you still can ensure data-locality or run a customised instance e.t.c. if you have requirements around that. Plus licensing is approx. 40% of the full SaaS cost at scale so may be cheaper to deploy that way.

But why are they not using VPN?

common reasons could be :-

- Cost, VPNs and the hardware to run them can be expensive

- Single point of failure. If you run all your remote access through a VPN gateway then you run the risk of disruption if it goes down. Of course you can implement redundnt/multiple gateways but that increases cost.

- Complexity for B2B setups. If you're exposing an API and you want third party services to access it, it can be more complex if there's a VPN involved.

All that said, I still wouldn't run something like this (or indeed most services) directly on the Internet as it's a single vuln. away from problems, however I've seen plenty of services directly visible on the Internet for these reasons. You can spelunk around one of the search engines like Shodan or Censys to get an idea of how many people run application services directly on the Internet.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#27

Post by skinkestek »

m_eiman wrote: post #6
echelon wrote: post #4

I am not in the least bit shocked. Atlassian products are some of the worst glued-together garbage in the industry. The entire product surface area is probably rife with exploits. Using Confluence or Jira will show you just how much Atlassian cares about its own products. I'd love for this to be the straw that breaks the camel's back and makes IT/infosec orgs move away from this bilge.

Any suggestions on what to use instead of Confluence? Need to run on-prem, it's mostly the wiki-like features I'm interested in.

> Need to run on-prem, it's mostly the wiki-like features I'm interested in.

Since you are looking mostly for the wiki part there is Dokuwiki which is magnitudes better at being a wiki. Remember, wiki is derived from the Hawaiian word for quick or something to that effect and whatever Confluence is it isn't quick.

Don't know how well it will hold up under scrutiny if black hats gets a reason to swarm over it, but unlike Confluence you can hire someone to patch the guts of it if necessary.

Edit: I have no reason to believe it is worse than anything else, I'm just pointing out it probably hasn't had so much exposure to help it harden.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#28

Post by macksd »

polote wrote: post #25

That's one of the selling point of Saas compared to hosted instance honestly. Some company think that having Confluence hosted internally is going to increase the security. But this is wrong. When you rely on a Saas provider. The provider has people who monitor the infrastructure constantly whereas when you hosted on your own server, the confluence instance is just one of the many services that they manage. And even…

This isn't always true. Using a SaaS is outsourcing these concerns, and sometimes you're outsourcing them to someone who will do better than you would and sometimes worse. I've worked on a couple of SaaS where security was absolutely not top priority. Especially in Silicon Valley, organizations often value growth over sound processes, fully staffed security teams, and managing tech debt. Many a SaaS has leaked customer data and survived, so many think they CAN allow that risk.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#29

Post by polote »

m_eiman wrote: post #6
echelon wrote: post #4

I am not in the least bit shocked. Atlassian products are some of the worst glued-together garbage in the industry. The entire product surface area is probably rife with exploits. Using Confluence or Jira will show you just how much Atlassian cares about its own products. I'd love for this to be the straw that breaks the camel's back and makes IT/infosec orgs move away from this bilge.

Any suggestions on what to use instead of Confluence? Need to run on-prem, it's mostly the wiki-like features I'm interested in.

Biased but I'm actually building a competitor (V1 is almost ready) to Confluence for medium to big organizations. But I don't understand your requirement for on-prem. That's clearly not an advantage from the security point of view. Apart from Quip, Sharepoint and Confluence (soon stopped) I'm not sure there is any commercial knowledge base tool that are available on-prem. The only thing that you can hope for, is "bring your bucket" in which static resources can be uploaded in your S3/Google/Azure bucket and some managed instance (like Atlassion Cloud) for the app. But on prem is going to be something from the past honestly

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#30

Post by polote »

macksd wrote: post #28
polote wrote: post #25

That's one of the selling point of Saas compared to hosted instance honestly. Some company think that having Confluence hosted internally is going to increase the security. But this is wrong. When you rely on a Saas provider. The provider has people who monitor the infrastructure constantly whereas when you hosted on your own server, the confluence instance is just one of the many services that they manage. And even…

This isn't always true. Using a SaaS is outsourcing these concerns, and sometimes you're outsourcing them to someone who will do better than you would and sometimes worse. I've worked on a couple of SaaS where security was absolutely not top priority. Especially in Silicon Valley, organizations often value growth over sound processes, fully staffed security teams, and managing tech debt. Many a SaaS has leaked custom…

I didn't say that it is always the case. The same argument you use can be used to talk about companies who are going to self host Confluence.

I agree that a lot of Saas startup are going to neglect security. But here we are talking about Knowledge base tools Saas companies. This is not some standard Saas company. They know they are in charge of company internal secrets. Or at lest I hope

Post reply on HN