Confluence セキュリティ勧告 - 2005-02-09

Confluence のセキュリティの概要とアドバイザリ

このページの内容

お困りですか?

アトラシアン コミュニティをご利用ください。

コミュニティに質問

A flaw has been found in Confluence by which attackers can bypass Confluence security and change content on the site. Atlassian STRONGLY recommends that all Confluence customers apply the fix described below immediately, or upgrade to Confluence 1.3.3

Vulnerability

By crafting custom URLs, any person with the ability to browse Confluence can modify content on the site, bypassing security settings. This vulnerability does not allow users to view content they would not normally be able to view, or escalate their privileges in other ways.

This flaw affects all versions of Confluence prior to 1.3.3, including the 1.4-DR development releases.

Fix

This vulnerability is fixed in Confluence 1.3.3 and later. Customers who do not wish to migrate to 1.3.3 can fix this bug using the procedure below:

  1. Edit the file confluence/WEB-INF/classes/xwork.xml
  2. Find the following section near the top of the file (around line 34):
    
    <interceptor-stack name="defaultStack">
        <interceptor-ref name="profiling">
            <param name="location">Before defaultStack</param>
        </interceptor-ref>
        <interceptor-ref name="transaction"/>
        <interceptor-ref name="authentication"/>
        <interceptor-ref name="requestParameterHack"/>
        <interceptor-ref name="eventnotifier"/>
        <interceptor-ref name="autowire"/>
        <interceptor-ref name="params"/>
        <interceptor-ref name="servlet"/>
        <interceptor-ref name="pageAware"/>
        <interceptor-ref name="permissions"/>
        <interceptor-ref name="profiling">
            <param name="location">After defaultStack</param>
        </interceptor-ref>
    </interceptor-stack>
    
  3. Locate the "autowire" and "params" entries:
    
                  <interceptor-ref name="eventnotifier"/>
    -->           <interceptor-ref name="autowire"/>      <--
    -->           <interceptor-ref name="params"/>        <--
                  <interceptor-ref name="servlet"/>
    
  4. Swap the two lines around. The whole stack should now look like this:
    
    <interceptor-stack name="defaultStack">
        <interceptor-ref name="profiling">
            <param name="location">Before defaultStack</param>
        </interceptor-ref>
        <interceptor-ref name="transaction"/>
        <interceptor-ref name="authentication"/>
        <interceptor-ref name="requestParameterHack"/>
        <interceptor-ref name="eventnotifier"/>
        <interceptor-ref name="params"/>
        <interceptor-ref name="autowire"/>
        <interceptor-ref name="servlet"/>
        <interceptor-ref name="pageAware"/>
        <interceptor-ref name="permissions"/>
        <interceptor-ref name="profiling">
            <param name="location">After defaultStack</param>
        </interceptor-ref>
    </interceptor-stack>
    
  5. Confluence を再起動します。
最終更新日: 2005 年 2 月 9 日

この内容はお役に立ちましたか?

はい
いいえ
この記事についてのフィードバックを送信する
Powered by Confluence and Scroll Viewport.