Atlassian Releases Patches to Fix Critical Confluence Flaw
Atlassian has disclosed a new critical flaw in its Confluence Server and Data Center products. The company explained in its security advisory that the vulnerability (CVE-2022-26138) lets unauthorized users use hardcoded credentials to get full access to Confluence.
According to Atlassian, the flaw exists in its Questions for Confluence app. It is designed to help employees share knowledge and connect with their co-workers via questions and answers. The app provides searching, filtering, and sorting options to make it easier for users to find relevant information. It is currently deployed on more than 8,000 Confluence servers worldwide.
Essentially, the Questions for Confluence app creates a default user account with a hard-coded user name and password “disabledsystemuser.” This approach helps to facilitate data migrations from the app to the cloud. However, the hard-coded password could be abused by hackers to log in to vulnerable servers.
“The disabledsystemuser account is created with a hardcoded password and is added to the confluence-users group, which allows viewing and editing all non-restricted pages within Confluence by default. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access any pages the confluence-users group has access to,” the company explained.
Atlassian recommends updating to a patched version
Atlassian has confirmed that the problem affects all companies using the Questions for Confluence app version 2.7.x and 3.0.x. However, it doesn’t impact Confluence Cloud customers.
The company recommends that organizations should install the latest Questions for Confluence update (versions 2.7.x >= 2.7.38 or versions higher than 3.0.5). Alternatively, customers can disable or delete the “disabledsystemuser” account to mitigate the issue.
Atlassian has acknowledged that attackers have yet to exploit the security flaw. That said, it has encouraged IT admins to check for the last authentication time for the specific account by following this step-by-step guide. This should help them find any exploitation attempts on vulnerable servers.
More in Security
Microsoft Entra ID Governance Service is Now Generally Available
Jun 7, 2023 | Rabia Noureen
Google Workspace Introduces Passkey Support to Protect Users Against Phishing Attacks
Jun 7, 2023 | Rabia Noureen
Microsoft Discloses New 'Migraine' Flaw That Bypasses Built-In Protections on macOS
Jun 1, 2023 | Rabia Noureen
Microsoft Warns Chinese Volt Typhoon Hacking Group Infects Critical US Infrastructure
May 26, 2023 | Rabia Noureen
Microsoft Entra Introduces New Identity and Access Management Capabilities
May 24, 2023 | Rabia Noureen
New Microsoft 365 Defender Feature Automatically Blocks Adversary-in-the-Middle Campaigns
May 18, 2023 | Rabia Noureen
Most popular on petri