Confluence Security Advisory 2005-02-09

A flaw has been found in Confluence by which attackers can bypass Confluence security and change content on the site. Atlassian STRONGLY recommends that all Confluence customers apply the fix described below immediately, or upgrade to Confluence 1.3.3

Vulnerability

By crafting custom URLs, any person with the ability to browse Confluence can modify content on the site, bypassing security settings. This vulnerability does not allow users to view content they would not normally be able to view, or escalate their privileges in other ways.

This flaw affects all versions of Confluence prior to 1.3.3, including the 1.4-DR development releases.

Fix

This vulnerability is fixed in Confluence 1.3.3 and later. Customers who do not wish to migrate to 1.3.3 can fix this bug using the procedure below:

1. Edit the file confluence/WEB-INF/classes/xwork.xml
2. Find the following section near the top of the file (around line 34):

   <interceptor-stack name="defaultStack">
       <interceptor-ref name="profiling">
           <param name="location">Before defaultStack</param>
       </interceptor-ref>
       <interceptor-ref name="transaction"/>
       <interceptor-ref name="authentication"/>
       <interceptor-ref name="requestParameterHack"/>
       <interceptor-ref name="eventnotifier"/>
       <interceptor-ref name="autowire"/>
       <interceptor-ref name="params"/>
       <interceptor-ref name="servlet"/>
       <interceptor-ref name="pageAware"/>
       <interceptor-ref name="permissions"/>
       <interceptor-ref name="profiling">
           <param name="location">After defaultStack</param>
       </interceptor-ref>
   </interceptor-stack>
   

3. Locate the "autowire" and "params" entries:

                 <interceptor-ref name="eventnotifier"/>
   -->           <interceptor-ref name="autowire"/>      <--
   -->           <interceptor-ref name="params"/>        <--
                 <interceptor-ref name="servlet"/>
   

4. Swap the two lines around. The whole stack should now look like this:

   <interceptor-stack name="defaultStack">
       <interceptor-ref name="profiling">
           <param name="location">Before defaultStack</param>
       </interceptor-ref>
       <interceptor-ref name="transaction"/>
       <interceptor-ref name="authentication"/>
       <interceptor-ref name="requestParameterHack"/>
       <interceptor-ref name="eventnotifier"/>
       <interceptor-ref name="params"/>
       <interceptor-ref name="autowire"/>
       <interceptor-ref name="servlet"/>
       <interceptor-ref name="pageAware"/>
       <interceptor-ref name="permissions"/>
       <interceptor-ref name="profiling">
           <param name="location">After defaultStack</param>
       </interceptor-ref>
   </interceptor-stack>
   

5. Restart Confluence.