Exploitation is underway for a critical flaw in Atlassian Confluence Server and Data Center

Threat actors are actively exploiting the recently patched critical flaw in Atlassian Confluence Server and Data Center

Recenlty Atlassian released security updates to address a critical hardcoded credentials vulnerability in Confluence Server and Data Center tracked as CVE-2022-26138.

A remote, unauthenticated attacker can exploit the vulnerability to log into unpatched servers.

Once installed the Questions for Confluence app (versions 2.7.34, 2.7.35, and 3.0.2), a Confluence user account with the username “disabledsystemuser” is created.

According to Atlassian, the account allows administrators to migrate data from the app to Confluence Cloud. The bad news is that the account is created with a hard-coded password and is added to the confluence-users group, which allows viewing and editing all non-restricted pages within Confluence by default.

“When the Questions for Confluence app is enabled on Confluence Server or Data Center, it creates a Confluence user account with the username disabledsystemuser. This account is intended to aid administrators that are migrating data from the app to Confluence Cloud. The disabledsystemuser account is created with a hardcoded password and is added to the confluence-users group, which allows viewing and editing all non-restricted pages within Confluence by default.”  reads the advisory published by Atlassian. “A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access any pages the group has access to.”

The affected versions are:

Questions for Confluence 2.7.x	2.7.34 2.7.35
Questions for Confluence 3.0.x	3.0.2

The company pointed out that uninstalling the Questions for Confluence app does not solve this vulnerability because the disabledsystemuser account is not removed after the app has been uninstalled. Admins of impacted Confluence Server or Data Center instances can remediate this vulnerability with the following actions:

Option 1: Update to a non-vulnerable version of Questions for ConfluenceOption 2: Disable or delete the disabledsystemuser account

The attacks exploiting the issue began after the release of the hard-coded credentials on Twitter.

Rapid7 researchers pointed out that the exploitation of the CVE-2022-26138 flaw is underway.

“This easily allows a remote, unauthenticated attacker to browse an organization’s Confluence instance. Unsurprisingly, it didn’t take long for Rapid7 to observe exploitation once the hardcoded credentials were released, given the high value of Confluence for attackers who often jump on Confluence vulnerabilities to execute ransomware attacks.” reads the post published by Rapid7 researchers.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Atlassian)