Atlassian fixes critical flaws in Confluence, Jira, Bitbucket and other products, update quickly!
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-26136 +1 in the same advisory: …26137 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4. NVD description · AI analysis pending | 9.8 group max | 5% |
| — | ||
| CVE-2022-26138 | Hard-coded Credentials in Atlassian Questions for Confluence App The Questions for Confluence app for Confluence Server and Data Center, when versions 2.7.34, 2.7.35, or 3.0.2 are installed, creates a user account named disabledsystemuser in the confluence-users group protected by a hard-coded password (CWE-798). Because the credential is embedded in the app, any remote, unauthenticated attacker who knows the password can log in to Confluence without a valid account. Successful exploitation grants access to all content that is accessible to the confluence-users group, which typically spans most of the instance's spaces and pages. Only Confluence Server and Data Center deployments that installed one of those app versions are affected, and the created account persists after installation. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-07-29 and carries a 98.2% EPSS score (100th percentile). Do: Upgrade the Questions for Confluence app to a fixed release per Atlassian's instructions, as required by the CISA KEV catalog. Check whether an account named disabledsystemuser exists in the confluence-users group; if present, delete it or change its hard-coded password, and review authentication logs for logins using that account. Prioritize internet-exposed Confluence Server and Data Center instances. | 9.8 | 98% | KEV |
| moderatelikely thousands of Confluence Server/Data Center instances (only those that installed the three named app versions) |
Full article568 words · extracted from helpnetsecurity.com · click to collapse
Atlassian has fixed three critical vulnerabilities and is urging customers using Confluence, Bamboo, Bitbucket, Crowd, Fisheye and Crucible, Jira and Jira Service Management to update their instances as soon as possible.
There is no mention of these vulnerabilities being exploited in the wild, but flaws in Atlassian Confluence are often leveraged by attackers.
About CVE-2022-26138
CVE-2022-26138 affects the Questions for Confluence app, which is deployed and used by some Confluence Server and Data Center customers.
When versions 2.7.34, 2.7.35, and 3.0.2 of the app are enabled on those products, a Confluence user account with the username disabledsystemuser is created with an associated hardcoded password, and added to the confluence-users group, which allows viewing and editing all non-restricted pages within Confluence by default.
“A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access any pages the confluence-users group has access to,” the company explained, and added that the password is trivial to obtain after downloading and reviewing affected versions of the app.
Because of this, and because uninstalling the app does not automatically remove the disabledsystemuser account, AND because it’s possible the account has been previously created by a version of the app that has been installed and uninstalled, Atlassian urges customers to check whether that active user account is present and to disable or delete it before or after updating to a non-vulnerable version of the app.
There’s also a way for defenders to check if anyone has ever successfully logged in to that account (and possibly exploited its existence).
About CVE-2022-26136 and CVE-2022-26137
CVE-2022-26136 and CVE-2022-26137 affect the Servlet Filter Dispatcher.
The former may allow a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps and to bypass authentication and to execute arbitrary Javascript in the user’s browser. The latter may allow an attacker to access the vulnerable application with the victim’s permissions. In both cases, user interaction is required (they have to be tricked into requesting a malicious URL).
“The impact [of CVE-2022-26136] depends on which filters are used by each app, and how the filters are used. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability,” the company said.
There are no workarounds or mitigation actions users can make – upgrading the affected installations of the following products is strongly advised (even if the instances are not connected to the internet):
- Confluence Server and Data Center
- Bamboo Server and Data Center
- Bitbucket Server and Data Center
- Crowd Server and Data Center
- Crucible
- Fisheye
- Jira Software Server and Data Center
- Jira Service Management Server and Data Center.
“These vulnerabilities affect the code included with each affected product. Systems are still affected even if they do not have any third-party apps installed,” Atlassian added.
“Unfortunately, Atlassian cannot confirm if an instance has been compromised. Please involve the local security team or a specialist security forensics firm for further investigation. Atlassian recommends checking the integrity of the application filesystem, for example, comparison of artifacts in their current state with recent backups to see if there are any unexpected differences. All security compromises are different, and there is a risk that an attacker could hide their footprint and change important files such as (syslogs, audit logs, access logs, etc.) depending on the component that has been compromised.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/07/21/atlassian-confluence-jira-bitbucket-critical/