Headline
Critical Bugs Threaten to Crack Atlassian Confluence Workspaces Wide Open
A hardcoded password associated with the Questions for Confluence app has been publicly released, which will likely lead to exploit attempts that give cyberattackers access to all Confluence content.
Atlassian on Thursday urged organizations using its Questions for Confluence app to immediately update to the latest version of the software or to apply a mitigation measure to protect against a critical vulnerability in the product — one of three critical bugs disclosed by the vendor this week.
The “patch now” advice was prompted by the public disclosure of a hardcoded password associated with the Questions app that gives a remote, unauthenticated attacker a way to log into Confluence and access all content in the broader confluence-users group.
Many organizations use Confluence for project management and collaboration among teams scattered across on-premises and remote locations. Often Confluence environments can house sensitive data on projects that an organization might be working on, or on its customers and partners.
The Questions app meanwhile allows for a Q&A/crowdsourcing function within a given workspace.
The problem primarily impacts organizations using Questions for Confluence Server and Data Center versions 2.7.34, 2.7.35, and 3.0.2 of the app. However, even organizations using other versions of Confluence could potentially be affected, Atlassian said. The vulnerability does not affect the Questions for Confluence app for Confluence Cloud.
Bracing for Exploits
“The issue is likely to be exploited in the wild now that the hardcoded password is publicly known,” Atlassian warned. “This vulnerability (CVE-2022-26138) should be remediated on affected systems immediately,” the vendor said.
Atlassian disclosed the bug on Wednesday. The company described the issue as resulting from a Confluence user account that is created when the Questions for Confluence app is enabled either on Confluence Data Center or Confluence Server. The user account — with the username “disabledsystemuser” — is designed to help administrators migrating data from these apps to Confluence Cloud.
But the account is created with a hardcoded password that is added to the confluence-users group. This allows attackers to view and edit all non-restricted pages within the Confluence user-group by default, according to Atlassian. So, any attacker with knowledge of the password can log in remotely to the Confluence collaboration environment and access whatever content other users in the group can access, the software vendor said.
Soon after Atlassian’s advisory Wednesday, a security researcher published the hardcoded password on Twitter, prompting Atlassian’s urgent update Thursday.
The company’s advisory provided details on how organizations can determine if they are affected by the vulnerability or might have already been compromised via an exploit targeting the flaw. Atlassian urged organizations to update to versions 2.7.38 or 3.0.5 of the software or to disable or delete the disabledsystemuser account.
Importantly, merely uninstalling the Questions for Confluence application would not remediate against the vulnerability because the disabledsystemuser account would still remain in place after the app is removed, Atlassian warned.
Two Other Critical Vulnerabilities
The other two critical vulnerabilities that were disclosed (CVE-2022-26136 and CVE-2022-26137) exist in multiple versions of almost all Atlassian products. These include Bamboo Server and Data Center, Bitbucket Server and Data Center, Confluence Server and Data Center, Crowd Server and Data Center, Jira Server and Data Center, and Jira Service Management Server and Data Center.
CVE-2022-26136 is an authentication-bypass vulnerability in Java code called Servlet Filter for intercepting and processing HTTP requests from and to a client and a backend system. The vulnerability gives attackers a way to use a specially crafted HTTP request to bypass Servlet Filters that third-party apps might use to enforce authentication.
The same vulnerability also allows attackers to use specially crafted HTTP requests to trick users into executing arbitrary JavaScript in the user’s browser.
Atlassian said it had been able to confirm such attacks are possible but has still not been able to determine all third-party apps that might be affected by the issue.
The flaw tracked as CVE-2022-26137 also exists in Servlet Filter and gives remote, unauthenticated attackers a way to access vulnerable applications by using a specially crafted HTTP request to trick users into requesting a malicious URL. Atlassian has released updated versions of its software for all affected products to address these vulnerabilities.
Atlassian’s Ongoing Cybersecurity Woes
The latest flaws mark the second time in the past two months that organizations using Atlassian’s technology have been forced to scramble to fix serious flaws in its products.
In early June, the company disclosed a critical remote code-execution vulnerability (RCE) impacting all supported versions of Confluence Server and Data Center. The bug (CVE-2022-26134) gave unauthenticated attackers a way to drop a Web shell on affected systems. It generated considerable concern because threat actors had already begun exploiting it by the time the company issued a fix for it.
Attackers quickly began actively exploiting the flaw to distribute a variety of malware, including Mirai bot variants, cryptominers, ransomware and the Cobalt Strike post-exploit attack kit. Many of the attacks were automated in nature.
An analysis by Barracuda showed that 45% of attempts to exploit the vulnerability were from Russia-based IP addresses; 25% percent of the exploit attacks were from the US; and 11% originated from IP addresses in India.
Related news
By Deeba Ahmed Another day, another Linux malware! This is a post from HackRead.com Read the original post: New Linux Malware Alert: ‘Spinning YARN’ Hits Docker, Other Key Apps
A four-year-old critical security flaw impacting Fortinet FortiOS SSL has emerged as one of the most routinely and frequently exploited vulnerabilities in 2022. "In 2022, malicious cyber actors exploited older software vulnerabilities more frequently than recently disclosed vulnerabilities and targeted unpatched, internet-facing systems," cybersecurity and intelligence agencies from the Five
As many as 55 zero-day vulnerabilities were exploited in the wild in 2022, with most of the flaws discovered in software from Microsoft, Google, and Apple. While this figure represents a decrease from the year before, when a staggering 81 zero-days were weaponized, it still represents a significant uptick in recent years of threat actors leveraging unknown security flaws to their advantage. The
Microsoft is warning of an uptick in the nation-state and criminal actors increasingly leveraging publicly-disclosed zero-day vulnerabilities for breaching target environments. The tech giant, in its 114-page Digital Defense Report, said it has "observed a reduction in the time between the announcement of a vulnerability and the commoditization of that vulnerability," making it imperative that
A now-patched critical security flaw affecting Atlassian Confluence Server that came to light a few months ago is being actively exploited for illicit cryptocurrency mining on unpatched installations. "If left unremedied and successfully exploited, this vulnerability could be used for multiple and more malicious attacks, such as a complete domain takeover of the infrastructure and the deployment
Squiz Matrix CMS 6.20 is vulnerable to an Insecure Direct Object Reference caused by failure to correctly validate authorization when submitting a request to change a user's contact details.
Hello everyone! This is the second episode of Vulnerability Management news and publications. In fact, this is a collection of my posts from the avleonovcom and avleonovrus telegram channels. Therefore, if you want to read them earlier, subscribe to these channels. Alternative video link (for Russia): https://vk.com/video-149273431_456239097 What’s in this episode: Microsoft released a propaganda […]
By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. After what seems like forever and honestly has been a really long time, we’re heading back to BlackHat in-person this year. We’re excited to see a lot of old friends again to commiserate, hang out, trade stories and generally talk about security. Throughout the two days of the main conference, we’ll have a full suite of flash talks at the Cisco Secure booth and several sponsored talks. Since this is the last edition of the newsletter before BlackHat starts, it’s probably worthwhile running through all the cool stuff we’ll have going on at Hacker Summer Camp. Our booth should be easy enough to find — it’s right by the main entrance to Bayside B. If you get to the Trellix Lounge, you’ve gone too far north. Our researchers will be there to answer any questions you have and present on a wide variety of security topics, from research into Adobe vulnerabilities to the privacy effects of the overtur...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added the recently disclosed Atlassian security flaw to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. The vulnerability, tracked as CVE-2022-26138, concerns the use of hard-coded credentials when the Questions For Confluence app is enabled in Confluence Server and Data Center
A week after Atlassian rolled out patches to contain a critical flaw in its Questions For Confluence app for Confluence Server and Confluence Data Center, the shortcoming has now come under active exploitation in the wild. The bug in question is CVE-2022-26138, which concerns the use of a hard-coded password in the app that could be exploited by a remote, unauthenticated attacker to gain
Attackers almost immediately leapt on a just-disclosed bug, CVE-2022-26138, affecting Atlassian Confluence, which allows remote, unauthenticated actors unfettered access to Confluence data.
Jira, Bamboo, Bitbucket, Confluence, Fisheye/Crucible, and Questions for Confluence affected
Jira, Bamboo, Bitbucket, Confluence, Fisheye/Crucible, and Questions for Confluence affected
Jira, Bamboo, Bitbucket, Confluence, Fisheye/Crucible, and Questions for Confluence affected
Atlassian has rolled out fixes to remediate a critical security vulnerability pertaining to the use of hard-coded credentials affecting the Questions For Confluence app for Confluence Server and Confluence Data Center. The flaw, tracked as CVE-2022-26138, arises when the app in question is enabled on either of two services, causing it to create a Confluence user account with the username "
Atlassian has rolled out fixes to remediate a critical security vulnerability pertaining to the use of hard-coded credentials affecting the Questions For Confluence app for Confluence Server and Confluence Data Center. The flaw, tracked as CVE-2022-26138, arises when the app in question is enabled on either of two services, causing it to create a Confluence user account with the username "
Atlassian has rolled out fixes to remediate a critical security vulnerability pertaining to the use of hard-coded credentials affecting the Questions For Confluence app for Confluence Server and Confluence Data Center. The flaw, tracked as CVE-2022-26138, arises when the app in question is enabled on either of two services, causing it to create a Confluence user account with the username "
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14...
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14...
The 8220 cryptomining group has expanded in size to encompass as many as 30,000 infected hosts, up from 2,000 hosts globally in mid-2021. "8220 Gang is one of the many low-skill crimeware gangs we continually observe infecting cloud hosts and operating a botnet and cryptocurrency miners through known vulnerabilities and remote access brute forcing infection vectors," Tom Hegel of SentinelOne
Hello everyone! In this episode, I will try to revive Security News with a focus on Vulnerability Management. On the one hand, creating such reviews requires free time, which could be spent more wisely, for example, on open source projects or original research. On the other hand, there are arguments in favor of news reviews. […]
Dark Reading's digest of the other don't-miss stories of the week, including YouTube account takeovers and a sad commentary on cyber-pro hopelessness.
A cloud threat actor group tracked as 8220 has updated its malware toolset to breach Linux servers with the goal of installing crypto miners as part of a long-running campaign. "The updates include the deployment of new versions of a crypto miner and an IRC bot," Microsoft Security Intelligence said in a series of tweets on Thursday. "The group has actively updated its techniques and payloads
Plus: Google issues fixes for Android bugs, and Cisco, Citrix, SAP, WordPress, and more issue major patches for enterprise systems.
A recently patched critical security flaw in Atlassian Confluence Server and Data Center products is being actively weaponized in real-world attacks to drop cryptocurrency miners and ransomware payloads. In at least two of the Windows-related incidents observed by cybersecurity vendor Sophos, adversaries exploited the vulnerability to deliver Cerber ransomware and a crypto miner called z0miner
In response to a comment about the Prophet Mohammed, a hacktivist group in Malaysia has unleashed a wave of cyber attacks in India.
Microsoft has warned of APT groups and ransomware authors exploiting the now patched Confluence vulnerability. We take a look at the dangers. The post “Multiple adversaries” exploiting Confluence vulnerability, warns Microsoft appeared first on Malwarebytes Labs.
This Metasploit module exploits an OGNL injection in Atlassian Confluence servers. A specially crafted URI can be used to evaluate an OGNL expression resulting in OS command execution.
A vulnerability in Atlassian Confluence was found by performing an incident response investigation on a compromised server. The vulnerability is not yet patched. The post Unpatched Atlassian Confluence vulnerability is actively exploited appeared first on Malwarebytes Labs.