Patch Now: Atlassian Confluence Bug Under Active Exploit

Attackers almost immediately leapt on a just-disclosed bug, CVE-2022-26138, affecting Atlassian Confluence, which allows remote, unauthenticated actors unfettered access to Confluence data.

Atlassian sign.Source: Michael VI via Shutterstock

A critical Atlassian Confluence vulnerability that was disclosed last week is now being actively exploited in the wild, researchers are warning.

According to researchers at Rapid7, the bug in question (CVE-2022-26138, one of three patched last week) is due to a hardcoded password in the Questions for Confluence app, which would allow cyberattackers to gain complete access to data within the on-premises Confluence Server and Confluence Data Center platforms.

More specifically, once installed, the Questions for Confluence app will "create a user account with a hard-coded password and add the account to a user group, which allows access to all nonrestricted pages in Confluence," according to Rapid7's posting. "This easily allows a remote, unauthenticated attacker to browse an organization’s Confluence instance."

The stakes are high. Many organizations use Confluence for project management and collaboration among teams scattered across on-premises and remote locations. Often Confluence environments can house sensitive data on projects that an organization might be working on, or house it on its customers and partners.

Organizations are urged to patch quickly because the password was made public last week, prompting emergency action by Atlassian. Confluence is unfortunately a popular target for attackers, as evidenced by the active exploitation of the bug tracked as CVE-2022-26134 in June, used to spread ransomware.

Admins should note: The bug only exists when the Questions for Confluence app is enabled, and it does not impact the Confluence Cloud instance. However, crucially, “uninstalling the Questions for Confluence app does not remediate this vulnerability," according to Atlassian's advisory last week.

"Confluence has had no shortage of headlines," Rick Holland, CISO at Digital Shadows, said via email. "Hardcoded passwords significantly increase the likelihood of exploitation, especially when the passwords become widely shared. If you play soccer, hardcoded passwords are 'own goals.' Adversaries score enough goals alone; we don't need to put the ball in our own net. Never use hardcoded passwords; take the time to set up proper authentication and minimize future risks."

About the Author(s)

Tara Seals, Managing Editor, News, Dark Reading

Tara Seals has 20+ years of experience as a journalist, analyst and editor in the cybersecurity, communications and technology space. Prior to Dark Reading, Tara was Editor in Chief at Threatpost, and prior to that, the North American news lead for Infosecurity Magazine. She also spent 13 years working for Informa (formerly Virgo Publishing), as executive editor and editor-in-chief at publications focused on both the service provider and the enterprise arenas. A Texas native, she holds a B.A. from Columbia University, lives in Western Massachusetts with her family and is on a never-ending quest for good Mexican food in the Northeast.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights