CVE-2022-26138
CRITICAL KEV RANSOMWARE NUCLEIAtlassian Questions For Confluence - Hardcoded Credentials
Title source: nucleiExploitation Summary
CVE-2022-26138 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added July 29, 2022, with confirmed use in ransomware campaigns. EIP tracks 4 public exploits from researchers including alcaparra, z92g, Vulnmachines. A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC demonstrates an authentication bypass vulnerability in Atlassian Questions For Confluence due to hardcoded credentials. The exploit involves using predefined credentials to log in as a user with access to the confluence-users group.
Description
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
Exploits (4)
This PoC demonstrates an authentication bypass vulnerability in Atlassian Questions For Confluence due to hardcoded credentials. The exploit involves using predefined credentials to log in as a user with access to the confluence-users group.
This repository contains a Go-based scanner for CVE-2022-26138, which checks for the presence of a hardcoded password vulnerability in Confluence. It supports both single and batch scanning modes and logs vulnerable hosts.
This repository documents CVE-2022-26138, a hardcoded credential vulnerability in the 'Questions for Confluence' app. The app creates a user account with a fixed username and password, allowing unauthorized access to Confluence content.
This PoC checks for CVE-2022-26138, an authentication bypass vulnerability in Atlassian Confluence. It sends a crafted login request and checks for a 302 redirect to determine vulnerability.
Nuclei Templates (1)
http.component:"Atlassian Confluence" || http.component:"atlassian confluence"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H