CVE-2020-35122
📋 TL;DR
This vulnerability allows authenticated Confluence users to bypass access controls in the Keysight Database Connector plugin, enabling them to execute arbitrary SQL queries against saved database connections. This affects Confluence servers running the vulnerable plugin version. Attackers could potentially read, modify, or delete database contents.
💻 Affected Systems
- Keysight Database Connector plugin for Confluence
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of connected databases including data theft, data destruction, or lateral movement to other systems via database connections.
Likely Case
Unauthorized data access and potential data manipulation in connected databases, leading to data breaches or integrity issues.
If Mitigated
Limited impact if proper database permissions are configured and sensitive data is segregated.
🎯 Exploit Status
Exploitation requires authenticated Confluence access but SQL injection is straightforward once access controls are bypassed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.0
Vendor Advisory: https://bitbucket.org/keysight/keysight-plugins-for-atlassian-products/wiki/Confluence%20Plugins/Database%20Plugin
Restart Required: Yes
Instructions:
1. Log into Confluence as administrator. 2. Go to Manage apps/add-ons. 3. Find Keysight Database Connector plugin. 4. Update to version 1.5.0 or later. 5. Restart Confluence service.
🔧 Temporary Workarounds
Disable plugin
allTemporarily disable the vulnerable plugin until patching is possible
Navigate to Confluence admin > Manage apps > Find Keysight Database Connector > Disable
Restrict database permissions
allConfigure database connections with minimal required permissions
Review and modify database user permissions to limit access to only necessary operations
🧯 If You Can't Patch
- Remove or disable all saved database connection profiles in the plugin configuration
- Implement network segmentation to isolate Confluence servers from sensitive databases
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Confluence admin panel under Manage apps/add-ons for Keysight Database ConnectorCheck Version:
Check via Confluence web interface: Admin > Manage apps > Find Keysight Database ConnectorVerify Fix Applied:
Verify plugin version is 1.5.0 or higher in Confluence admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual database query patterns from Confluence application logs
- Multiple failed SQL queries or syntax errors from plugin
Network Indicators:
- Unexpected database connections from Confluence server
- Unusual SQL traffic patterns
SIEM Query:
source="confluence.log" AND "Keysight Database Connector" AND ("SQL" OR "database" OR "query")