Atlassian Confluence addressed a Critical Flaw

Atlassian released security updates for critical hardcoded credentials vulnerability in Confluence Server and Data Center tracked as CVE-2022-26138. In which the remote unauthenticated attacker can exploit the vulnerability to log into unpatched servers.

Once installed the Questions Confluence application a Confluence user account with the username “disabledsystemuser” is created.

The account allows administrators to migrate data from the app to Confluence Cloud. The bad news is that the account is created with a hard-coded password and is added to the  confluence-users  group, which allows viewing and editing all non-restricted pages within Confluence by default.

The affected versions are:Questions for Confluence 2.7.x2.7.34 x2.7.35 Questions for Confluence 3.0.x3.0.2

Uninstalling the Questions for Confluence app does not solve this vulnerability because the disabledsystemuser account is not removed after the app has been uninstalled.

Admins of impacted Confluence Server or Data Center instances can remediate this vulnerability with the following actions:

• Update to a non-vulnerable version of Questions for Confluence
• Disable or delete the disabledsystemuser account

Atlassian is not aware of attacks in the wild exploiting this vulnerability.

To check if anyone used the hardcoded password to log into the disabledsystemuser account, admins can get a list of users’ last logon times and if the last authentication time for the hardcoded account is null, that means the account was never used to access the device.