Last updated at Fri, 29 Jul 2022 21:35:54 GMT
Exploitation is underway for one of the trio of critical Atlassian vulnerabilities that were published last week affecting several the company’s on-premises products. Atlassian has been a focus for attackers, as it was less than two months ago that we observed exploitation of CVE-2022-26134 in Confluence Server and Confluence Data Center.
CVE-2022-26138: Hardcoded password in Questions for Confluence app impacting:
- Confluence Server
- Confluence Data Center
CVE-2022-26136 & CVE-2022-26137: Multiple Servlet Filter vulnerabilities impacting:
- Bamboo Server and Data Center
- Bitbucket Server and Data Center
- Confluence Server and Data Center
- Crowd Server and Data Center
- Crucible
- Fisheye
- Jira Server and Data Center
- Jira Service Management Server and Data Center
CVE-2022-26138: Hardcoded password in Questions for Confluence app
The most critical of these three is CVE-2022-26138, as it was quickly exploited in the wild once the hardcoded password was released on social media. There is a limiting function here, however, as this vulnerability only exists when the Questions for Confluence app is enabled (and does not impact the Confluence Cloud instance). Once the app is enabled on affected versions, it will create a user account with a hardcoded password and add the account to a user group, which allows access to all non-restricted pages in Confluence. This easily allows a remote, unauthenticated attacker to browse an organization’s Confluence instance. Unsurprisingly, it didn’t take long for Rapid7 to observe exploitation once the hardcoded credentials were released, given the high value of Confluence for attackers who often jump on Confluence vulnerabilities to execute ransomware attacks.
Affected versions
-
Questions for Confluence 2.7.x
- 2.7.34
- 2.7.35
-
Questions for Confluence
- 3.0.x
- 3.0.2
Mitigation guidance
Organizations using on-prem Confluence should follow Atlassian’s guidance on updating their instance or disabling/deleting the account. Rapid7 recommends organizations impacted by this take steps immediately to mitigate the vulnerability. Atlassian’s advisory also includes information on how to look for evidence of exploitation. An FAQ has also been provided.
Please note: Atlassian’s Questions For Confluence Security Advisory 2022-07-20 has a very important call-out that “uninstalling the Questions for Confluence app does not remediate this vulnerability.”
CVE-2022-26136 & CVE-2022-26137: Multiple Servlet Filter vulnerabilities
Two other vulnerabilities were announced at the same time, CVE-2022-26136 and CVE-2022-26137, which are also rated critical by Atlassian. They both are issues with Servlet Filters in Java and can be exploited by remote, unauthenticated attackers. Cloud versions of Atlassian have already been fixed by the company.
The list of affected versions is long and can be found on Atlassian’s Security Advisory.
While the impact of these vulnerabilities will vary by organization, as mentioned above, attackers place a high value on many Atlassian products. Therefore, Rapid7 recommends that organizations update impacted product versions as there is no mitigation workaround available.
Rapid7 customers
InsightVM and Nexpose customers can assess their exposure to CVE-2022-26138 with a remote vulnerability check released on July 29, 2022 (ContentOnly-content-1.1.2602-202207292027).
Updates
07/29/2022 - 5:30 PM EDT
Updated Rapid7 customers section to include information on a new remote vulnerability check.
