{"id":22577,"date":"2022-07-22T19:57:49","date_gmt":"2022-07-22T19:57:49","guid":{"rendered":"https:\/\/harchi90.com\/hardcoded-password-in-confluence-app-has-been-leaked-on-twitter\/"},"modified":"2022-07-22T19:57:49","modified_gmt":"2022-07-22T19:57:49","slug":"hardcoded-password-in-confluence-app-has-been-leaked-on-twitter","status":"publish","type":"post","link":"https:\/\/harchi90.com\/hardcoded-password-in-confluence-app-has-been-leaked-on-twitter\/","title":{"rendered":"Hardcoded password in Confluence app has been leaked on Twitter"},"content":{"rendered":"<div itemprop=\"articleBody\">\n<figure class=\"intro-image intro-left\">\n  <figcaption class=\"caption\">\n<p>Getty Images<\/p>\n<\/figcaption><\/figure>\n<aside id=\"social-left\" class=\"social-left\" aria-label=\"Read the comments or share this article\">\n<\/aside>\n<p><!-- cache hit 217:single\/related:3fcc8c189868ee6cf930f6b9511548ce --><!-- empty --><\/p>\n<p>What&#8217;s worse than a widely used Internet-connected enterprise app with a hardcoded password?  Try said enterprise app after the hardcoded password has been leaked to the world.<\/p>\n<p>Atlassian on Wednesday revealed three critical product vulnerabilities, including CVE-2022-26138 stemming from a hardcoded password in Questions for Confluence, an app that allows users to quickly receive support for common questions involving Atlassian products.  The company warned the passcode was &#8220;trivial to obtain.&#8221;<\/p>\n<p>The company said that Questions for Confluence had 8,055 installations at the time of publication.  When installed, the app creates a Confluence user account named disabledsystemuser, which is intended to help admins move data between the app and the Confluence Cloud service.  The hardcoded password protecting this account allows for viewing and editing of all non-restricted pages within Confluence.<\/p>\n<p>&#8220;A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access any pages the confluence-users group has access to,&#8221; the company said.  &#8220;It is important to remediate this vulnerability on affected systems immediately.&#8221;<\/p>\n<p>A day later, Atlassian was back to report that &#8220;an external party has discovered and publicly disclosed the hardcoded password on Twitter,&#8221; leading the company to ratchet up its warnings.<\/p>\n<p>&#8220;This issue is likely to be exploited in the wild now that the hardcoded password is publicly known,&#8221; the updated advisory read.  &#8220;This vulnerability should be remediated on affected systems immediately.&#8221;<\/p>\n<p>The company warned that even when Confluence installations don&#8217;t actively have the app installed, they may still be vulnerable.  Uninstalling the app doesn&#8217;t automatically remediate the vulnerability because the disabledsystemuser account can still reside on the system.<\/p>\n<aside class=\"ad_wrapper\" aria-label=\"In Content advertisement\">\n    <span class=\"ad_notice\">Advertisement <\/span>    <\/p>\n<\/aside>\n<p>To figure out if a system is vulnerable, Atlassian advised Confluence users to search for accounts with the following information:<\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">User: <\/span><span style=\"font-weight: 400;\">disabledsystemuser<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Username: <\/span><span style=\"font-weight: 400;\">disabledsystemuser<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">E-mail: <\/span><span style=\"font-weight: 400;\">dontdeletethisuser@email.com<\/span><\/li>\n<\/ul>\n<p>Atlassian provided more instructions for locating such accounts here.  The vulnerability affects Questions for Confluence versions 2.7.x and 3.0.x.  Atlassian provided two ways for customers to fix the issue: disable or remove the &#8220;disabledsystemuser&#8221; account.  The company has also published this list of answers to frequently asked questions.<\/p>\n<p>Confluence users looking for exploitation evidence can check the last authentication time for disabledsystemuser using the instructions here.  If the result is null, the account exists on the system, but no one has yet signed in using it.  The commands also show any recent login attempts that were successful or unsuccessful.<\/p>\n<p>&#8220;Now that the patches are out, one can expect patch diff and reversing engineering efforts to produce a public POC in a fairly short time,&#8221; Casey Ellis, founder of vulnerability reporting service Bugcrowd, wrote in a direct message.  &#8220;Atlassian shops should get on to patching public-facing products immediately, and those behind the firewall as quickly as possible. The comments in the advisory recommending against proxy filtering as mitigation suggest that there are multiple trigger pathways.<\/p>\n<p>The other two vulnerabilities Atlassian disclosed on Wednesday are also serious, affecting the following products:<\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Bamboo Server and Data Center<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Bitbucket Server and Data Center<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Confluence Server and Data Center<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Crowd Server and Data Center<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Crucible<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">fisheye<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Jira Server and Data Center<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Jira Service Management Server and Data Center<\/span><\/li>\n<\/ul>\n<p>Tracked as CVE-2022-26136 and CVE-2022-26137, these vulnerabilities make it possible for remote, unauthenticated hackers to bypass Servlet Filters used by first- and third-party apps.<\/p>\n<p>&#8220;The impact depends on which filters are used by each app, and how the filters are used,&#8221; the company said.  &#8220;Atlassian has released updates that fix the root cause of this vulnerability but has not exhaustively enumerated all potential consequences of this vulnerability.&#8221;<\/p>\n<p>Vulnerable Confluence servers have long been a favorite opening for hackers looking to install ransomware, cryptominers, and other forms of malware.  The vulnerabilities Atlassian disclosed this week are serious enough that admins should prioritize a thorough review of their systems, ideally before the weekend starts.<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Getty Images What&#8217;s worse than a widely used Internet-connected enterprise app with a hardcoded password? Try said enterprise app after the hardcoded password has been leaked to the world. Atlassian on Wednesday revealed three critical product vulnerabilities, including CVE-2022-26138 stemming from a hardcoded password in Questions for Confluence, an app that allows users to quickly &hellip;<\/p>\n<p class=\"read-more\"> <a class=\"\" href=\"https:\/\/harchi90.com\/hardcoded-password-in-confluence-app-has-been-leaked-on-twitter\/\"> <span class=\"screen-reader-text\">Hardcoded password in Confluence app has been leaked on Twitter<\/span> Read More &raquo;<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"default","ast-global-header-display":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[4],"tags":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack-related-posts":[{"id":21463,"url":"https:\/\/harchi90.com\/atlassian-rolls-out-security-patch-for-critical-confluence-vulnerability\/","url_meta":{"origin":22577,"position":0},"title":"Atlassian Rolls Out Security Patch for Critical Confluence Vulnerability","date":"July 21, 2022","format":false,"excerpt":"Atlassian has rolled out fixes to remediate a critical security vulnerability pertaining to the use of hard-coded credentials affecting the Questions For Confluence app for Confluence Server and Confluence Data Center. The flaw, tracked as CVE-2022-26138arises when the app in question is enabled on either of two services, causing it\u2026","rel":"","context":"In &quot;Technology&quot;","img":{"alt_text":"","src":"https:\/\/i0.wp.com\/thehackernews.com\/new-images\/img\/b\/R29vZ2xl\/AVvXsEgvfqow2z1XORevUpzKGWWXZ2DP4dMaNi-7cycpa3J_bSZKv0tO6MP40HLl7lvVJDIswOmb6I-YoNMLJym4v9oLZQczujsMqcttB3M_Cvm6E-zLs0XrpwaTZ_SGFjckDfi3CPfijZaii8Z88_btcKeHKKfxm7cDyF3kaVvsirGpb2JWVH0Ot3xGiC2sZg\/s1600\/strike-728.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":21160,"url":"https:\/\/harchi90.com\/atlassian-reveals-critical-flaws-across-its-product-line-the-register\/","url_meta":{"origin":22577,"position":1},"title":"Atlassian reveals critical flaws across its product line \u2022 The Register","date":"July 21, 2022","format":false,"excerpt":"Atlassian has warned users of its Bamboo, Bitbucket, Confluence, Fisheye, Crucible, and Jira products that a pair of critical-rated flaws threaten their security. The company's July security advisories detail \"Servlet Filter dispatcher vulnerabilities.\" One of the flaws \u2013 CVE-2022-26136 \u2013 is described as an arbitrary Servlet Filter bypass that means\u2026","rel":"","context":"In &quot;Technology&quot;","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"fifu_image_url":"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2022\/07\/password-login-760x380.jpeg","_links":{"self":[{"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/posts\/22577"}],"collection":[{"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/comments?post=22577"}],"version-history":[{"count":0,"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/posts\/22577\/revisions"}],"wp:attachment":[{"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/media?parent=22577"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/categories?post=22577"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/tags?post=22577"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}