US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing (opens in new tab)

You are missing the point entirely.

Any sufficiently complicated product will eventually have major CVEs, as you say. Anyone having hosted Atlassians product know that these products are nothing but garbage fires on the inside, as the commenter above said.

Both of these statements are true and not mutually exclusive in any way.

I don’t disagree with what you’re saying about software having ongoing vulnerability issues. But, that’s exactly what the problem is with communications-centric solutions that don’t offer strong data security protections such as end-to-end encryption: you’re always one CVE away from having your company’s data exposed. And, in this specific case, there is a MAJOR difference between Chrome getting owned, and the program that hosts all of a company’s internal communications concerning, among other things, known vulnerabilities in their software.

Think about that for a second. If someone finds a vulnerability in JIRA, they don’t just find a vulnerability in that software: they’ve got access to support tickets, issue tracking, etc about lots of vulnerabilities in lots of software. That’s a big deal.

The fact that the US government had to step in and say PLEASE TAKE THIS SERIOUSLY, rather than Atlassian going into a Code Red situation, shows that they just don’t take the level of responsibility they’ve been given as seriously as is required for what they’re doing. This isn’t just some lousy app having a CVE. This is the keys to the kingdom for a lot of very critical software. This is systemic risk. The problem isn’t the code, it’s the culture.

If you “work in the world of business software” and you think that’s a “complete bullshit statement,” I really hope you don’t work on anything for which such systemic risk is possible. Because, to turn your statement back on you, that’s a complete bullshit way to treat the responsibility you have for the data with which you’ve been trusted. Go build a social media app or an online shopping site or something, and stay out of critical systems that can create cascading vulnerabilities.

> awful engineering practices that underpin their products

Confluence has become an absolutely disgusting, bloated Javascript beast. The amount of JS that it loads is unbelievable.

Atlassian has a reputation for poor engineering/backend practices. It's a great (to use) product though.

I don't remember a company like whatsapp having this kind of problems.

I can see how you jumped to the conclusion this CVE means Atlassian is nonsense, but it’s not the only take on the comment. The discussion arising from a

I’m not really sure what the point of the rant is. It’s not as if such a comment conclusion is as big of deal to reality as an idiot staying unvaccinated.

But I get it; someone is “wrong”* on the internet.

* where wrong is defined very specifically to one or a handful of particular readers but the error doesn’t rise to being a real problem for humanity

JIRA has a solid use case (if maybe breeding ground for CVEs), confluence is just a bad competitor to OneNote. Its not a wiki...it stopped being a wiki a long time ago.

Mixed frontend and backend rendering = horrific slowness and impact on productivity

Atlassian products are vast, integrated, and support all the crazy draconian processes that every insane project manager wants to implement.

You can't easily dump Jira if you are using Jira, confluence, bitbucket, and whatever their CI/CD product is called (bamboo?)

This is the primary failing of many tech people/companies. You can't compete by just building a "better" technical product.

Everything from sales to support to customizations and integrations matter to companies, especially as they grow and develop their own teams and management structures which require the software mold into their workflows. Whether the management processes are the best is a different conversation, but being able to support any scenario is why Jira and Confluence are so successful.

It's the same reason why Salesforce has dominated CRMs even with so many "modern" alternatives around.

Because Jira is flexible and has the needed features and integrates with most things you care about. To the point where everyone in the org can tolerate it. Alternatives tend to focus on one group of users and the rest HATE the product.

I've tried a lot of these products and in the end come back to Jira because it works better on average for everyone.

The thing about products that occupy the kind of niche that Jira does is, the people using the product are not the people making the purchasing decision. They rarely even talk to each other.

If you come to a venue like Hacker News, you'll mostly be getting opinions of the people who actually use the product. These opinions do not reflect the interests and priorities of the people who decide which product to buy.

I wish I knew the answer as well. I believe many managers trained in the art of building software without knowing how to build software are too married to doing processes in a very specific way that's very tightly coupled to Jira, and feel safe and at home with the added complexity it provides, so they vouch for it. But that's just a theory from personal experience.

I used Clubhouse at a past job and it was great. I can understand why companies may not be able to move off of Jira, but I can't understand why one would start using it in today's world.

I think it already has been disrupted but no company is going to switch task management software without a really good reason. But I can't imagine and fresh companies are choosing Jira over Clubhouse, Asana, Trello or what I hope to be my company at some point! https://tahsk.com

The thing about Jira is that it provides much more than just tickets. It's really not even bad at what it does as far as user workflows go, it's just really easy to misconfigure due to lackluster administrative tooling.

I work with a Jira instance that has something like 20 years of history and over half a million tickets. Migrating just the tickets and their comments might be possible, but migrating all the other metadata and every service and automation we've integrated into the workflows (some of which we depend on to be able to work at all) would take months of work if a suitable alternative even exists in the first place.

If it were just tickets and some CI integrations, migrating away from Jira would be trivial, but that's not where all the value is.

There aren’t that many if your requirements include on-prem and being flexible enough to not be only for software development using agile.

And I've witnessed first hand the truly garbage nothing changes after adopting Jira and Confluence - a wasteland of process management through bad automation and forgotten wiki articles with Write Once Read Never behavior.

Nothing Atlassian does is that much better than past tooling, it all comes down to how you want to run your org, what discipline you apply, and where you apply it.

I suspect that a lot of Atlassian's criticism is a reflection of their dominant market position. Outside of smartphones and video game consoles, people generally don't spend much time complaining about products they don't use.

For my part, I've spent enough time using both Atlassian products and competitors to find something to hate in all of them. Familiarity breeds contempt.

> That's why they are still here, their product is still superior to the competition.

No. It's because their products are sticky in nature. The tools are used to hold the current state and historic knowledge of the organisation, and even the thought of replacing one of them gives IT manager types the shakes.

> Atlassian get a lot of criticism

Yeah, I think that perception used to be pretty hardcore years ago.

I eventually realised that so many, many companies use this software as a backbone to their company and operations. And for the majority of those, the companies like it. So much so that instead of migrating to a competitor, they move to the new cloud offering.

The search function is atrocious. Some of the most visited, highly important pages will not be found with exact title matches.

Is there a way to quickly mark a block as code? Because whatever nice feature it has are completely rendered irrelevant by this lack.

Same, closest I can find is a tunnel to the harbourfront[0]

[0] https://www.realestate.com.au/news/the-list-australias-top-t...

Failure to sanitize input is one thing, but the bigger issue to me is that, with so many of these Java server installations, that a simple injection can immediately lead to "game over" from a server takeover perspective.

For the bug in question, I bet the vast majority of webservers never need the ability to call unrestricted Runtime.exec(), yet access to that is just one unsanitized input away from complete control over your server.

OS vendors have made leaps and bounds in the past decade making it much harder for code vulnerabilities to lead to system takeover. I'd argue it's time for server code and language runtimes to make it easier to write secure code.

100%, I did the same thing on my side. If shit really hit the fan I could've lost my job because of this as it was my call to not patch. When I went back to the link provided in the email the self-registration part was removed so I looked like a complete tool over zoom when trying to explain this situation to my boss

I only got the 'update' from last Saturday, by then it was too late already. Their original advisory was from the 25th, they should have mailed me back then.

Yes, I did. I also ran an Exchange Message Trace (this is just standard Office 365, nothing fancy) and there was only 1 message from Atlassian in the last 15 days which was the update email that was too late to prevent exploitation. So they did not email me in time.

its' misleading and it gives off the notion that the cloud is more secure so you should migrate your instance to our managed "Cloud" version.

Let's say 99.5%, because Atlassian hosted offering is called "Atlassian Cloud"

> regardless of how technical they are

They said "lesser technical people", not "less-technical people". A more technical person might not be able to read between the lines, but a better technical person should.

Just say on-prem. Problem solved!

Really though, "self-hosted" would make even more sense, as companies often deploy such applications in one or more "off prem" environments anyway. I'd hardly consider my company's multi-region/multi-AZ AWS VPC to be my "premise".

(That first one should be "premises", but I didn't proof-read or notice in time to make an edit. Also the last sentence should have "self-hosted". Bad QA.)

The search engine will happily search any attached pdfs and return those. It just won't search the actual Confluence pages, which seems like it would be easier.

We have an internal search engine. It made Confluence usable.

For us specifically they blocked the server from downloading more assumedly dangerous tools. Blocked more privilege escalation and blocked crypto mining software from running.

Our teams were also able to do a “network isolation” and essentially bring the server offline quickly, without touching more pieces and possibly exposing our credentials or tokens.

We also had the paid Overwatch protection which is Crowdstrikes 24/7 security monitoring solution which resulted in an actual person emailing half our team at 1am letting us know this was happening and their recommended remediation steps.

I would explain it as next gen antivirus. Looks closer at hashes and heuristics of all data in and out to a server. It seems crazy that everything that is read or written is hashed and compared to a db, but it works.

FWIW, we dumped crowdstrike for Cisco AMP and have been happy.

It runs on every server that you install it on (currently happening at my company - lots of servers owned by lots of different departments need to have it instaked).

Yes.

I'd rather get a fully-formed Jira ticket, than a terse three-word titled empty ticket, that the PM will explain in a 9AM Zoom meeting. Just me though.

But jira is only a tool right? Blaming Atlassian for a poorly led organization seems slightly misguided.

At some project size, measured either by software complexity/interoperability or user base, you will need a tool to manage issues and tasks.

What you're talking about is an organization where developers are not empowered - but even empowered developers need an issue tracker or a board of some description.

A "management by jira" culture will not be remediated by tooling.

They've been doing a large transformation recently to put it on a new platform. Not saying that's an excuse, but it is an explanation for some of the problems they've had.

> Need to run on-prem, it's mostly the wiki-like features I'm interested in.

Since you are looking mostly for the wiki part there is Dokuwiki which is magnitudes better at being a wiki. Remember, wiki is derived from the Hawaiian word for quick or something to that effect and whatever Confluence is it isn't quick.

Don't know how well it will hold up under scrutiny if black hats gets a reason to swarm over it, but unlike Confluence you can hire someone to patch the guts of it if necessary.

Edit: I have no reason to believe it is worse than anything else, I'm just pointing out it probably hasn't had so much exposure to help it harden.

I am considering going with Bookstack Wiki for my company. But I am not a Fortune500 company.

I would say it is very darn complete, perhaps without the syntactic linking that Confluence has. The only thing missing from it, is a very solid backup and restore method from the admin panel. The authors want users to rely on database backups and file level backups, that must be handled manually. Essentially saying "not my problem".

Mediawiki has worked well. I’d be curious to hear others experiences with it.

VisualEditor is an extremely good WYSIWYG interface. The wiki is able to scale well (project sites are unlikely to approach Wikipedia scale). The API is useful. Wikitext editing gives power users a lot of flexibility, though it’s not as popular as Markdown.

Access control & edit-publish workflow options may be too limited for the desires of some project teams.

My company is currently migrating off of Confluence due to the ending of the on-premise license. We found a combination of a simple web-based knowledgebase app for public content and Office 365/Teams -- which we already license.

You could put Cloudflare Access (with Tunnel) in front to shield against exposing the instance directly, I’ve used it in the past for other products that has been good.

I migrated every confluence instance over to XWiki, since the Australian backdoor law[1].

http://www.xwiki.org/xwiki/bin/view/Main/WebHome

https://xwiki.com/en/try-xwiki/

[1] https://www.wired.com/story/australia-encryption-law-global-...

You can try Wiki.js or bookstack, both are open source and nice

What target group? Devs? Po? General org?

Biased but I'm actually building a competitor (V1 is almost ready) to Confluence for medium to big organizations. But I don't understand your requirement for on-prem. That's clearly not an advantage from the security point of view. Apart from Quip, Sharepoint and Confluence (soon stopped) I'm not sure there is any commercial knowledge base tool that are available on-prem. The only thing that you can hope for, is "bring your bucket" in which static resources can be uploaded in your S3/Google/Azure bucket and some managed instance (like Atlassion Cloud) for the app. But on prem is going to be something from the past honestly

Hit the nail on the head there.

New thing? Let’s open a new JIRA project and prefix with some random shit show workflow customised by someone who was clearly asleep or incompetent!

What's ironic...is instead of educating and offering a workable alternative, you actually made the problem worse and the sale easier for Atlassian!

No, the rest of the company shouldn't be required to enter the complex and esoteric world of Git and fire up a terminal + a bloated code editor and deal with merge conflicts just so they can collaborate on a simple text doc.

This reads like a horror story I'd find on the landing page of some Saas tool under a heading that reads, "The Problem"

Atlassian doesn't have a sales department (or at least this was the case for well over a decade, perhaps it could have changed now).

Not that many people “love” it, that’s why it’s always surprising how well it does. It’s pretty unpleasant to use but there isn’t really anything else out there that’s so well integrated so they keep winning despite the pain.

I didn't say that it is always the case. The same argument you use can be used to talk about companies who are going to self host Confluence.

I agree that a lot of Saas startup are going to neglect security. But here we are talking about Knowledge base tools Saas companies. This is not some standard Saas company. They know they are in charge of company internal secrets. Or at lest I hope

There is no “outside” and “inside” anymore. Have you ever had a penetration test on your network?

If you’re ok sharing things externally why self-host at all?

They are generally exposed through a proxy that sits in between. If you don't authenticate, you can't send a request to it at all.

(This is opposed to the lazy model, where your aplication is fully exposed to the web and you click log in and it redirects to SSO - if there is a vulnerability that doesn't require authentication you're already compromised)

The proxy will handle sign in and passes traffic to/from the webserver backend, and you should not be able to send a single HTTP request to the underlying application without the proxy capturing authentication and who the user that sent the request was.

All apps authenticate every request thus making lateral movement harder. IP addresses are not authentication. OS's don't control IP traffic in any meaningful way: confused deputies all the way down.

But why are they not using VPN?

Is that DNS DB publicly accessible?

> Arbitrary code execution in an on-premise server?

That doesn’t explain what the benefit of the attack is. It just explains that it’s an effective attack.

How would that information be useful?