Workaround for CVE-2022-26134 - Windows version

[Markus Sveinn Markusson]

Confluence Windows version 7.7.2.

The workaround suggested by Atlassian includes the replacement of three files, 

xwork-1.0.3-atlassian-10.jar
webwork-2.1.5-atlassian-4.jar
CachedConfigurationProvider.class

None of these files can be found in the Confluence directory tree.

Does this vulnerability apply to the Windows version, and if so, what would be the correct workaround?

[Andy Heinzer · Accepted solution]

Yes this vulnerability applies to Windows editions as well.  The files you mentioned are the replacement files.  Not the files that are currently on your system.  You need to download those specific files you mentioned from the Advisory itself.  Then remove the existing files with similar (but not exactly the same names).  Then copy in the downloaded files to their appropriate locations.  If you cannot find this folder, you might want to search for the

WEB-INF

folder instead.  Two of the jar files will be found in the WEB-INF/lib/ directory.

[Markus Sveinn Markusson]

Thank you, Andy.

You are correct, the two .jar files have older version numbers, understandibly.

The CachedConfigurationProvider.class is nowhere to be found, though.

Regards,
Markus

[Andy Heinzer]

Yes, that is expected as well.  That .class file has to added to a separate directory.

• Change to directory <confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup
 

  1. Create a new directory called webwork

  2. Copy CachedConfigurationProvider.class into <confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup/webwork

  3. Ensure the permissions and ownership are correct for:

     <confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup/webwork

     <confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup/webwork/CachedConfigurationProvider.class

[Markus Sveinn Markusson]

Thank you very much, Andy. Workaround procedure completed.