Critical Security Advisory: Questions For Confluence App Security Advisory- Hardcoded Credentials

Summary Questions For Confluence App Security Advisory- Hardcoded Credentials
Advisory Release Date Jul 20, 2022 10:00 AM PDT (Pacific Time, -7 hours)
Affected Products

Questions For Confluence app for:

  • Confluence Server
  • Confluence Data Center
Affected Versions Affected Versions List
Remediation Remediation Steps
CVE ID(s) – CVE-2022-26138

Summary of Questions for Confluence Vulnerability

When the Questions for Confluence app is enabled on Confluence Server or Data Center, it creates a Confluence user account with the username disabledsystemuser. This account is intended to aid administrators that are migrating data from the app to Confluence Cloud. The disabledsystemuser account is created with a hardcoded password and is added to the confluence-users group, which allows viewing and editing all non-restricted pages within Confluence by default. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence.

While Atlassian has not received any reports of this issue being exploited in the wild, the hardcoded password is trivial to obtain after downloading and reviewing affected versions of the app.

How To Determine If You Are Affected

A Confluence Server or Data Center instance is affected if it has an active user account with the following information:

  • User: disabledsystemuser
  • Username: disabledsystemuser
  • Email: dontdeletethisuser@email.com


Please note it is possible for this account to be present if the Questions for Confluence app has previously been installed and uninstalled.

If this account does not show up in the list of active users, the Confluence instance is not affected.

Affected Versions

These are the versions of the app that create the disabledsystemuser account with a hardcoded password. Confluence installations that do not actively have any of these versions of the app installed may still be affected. Refer to the How To Determine If You Are Affected section above and the Remediation section below for more information.

Product Affected Versions
Questions for Confluence 2.7.x
  • 2.7.34
  • 2.7.35
Questions for Confluence 3.0.x
  • 3.0.2

 

Remediation

**Uninstalling the Questions for Confluence app does NOT remediate this vulnerability. The disabledsystemuser account does not automatically get removed after the app has been uninstalled. If you have verified a Confluence Server or Data Center instance is affected, two equally effective ways to remediate this vulnerability are listed below.**

Option 1: Update to a non-vulnerable version of Questions for Confluence

Update the Questions for Confluence app to a fixed version:

  • 2.7.x >= 2.7.38 (compatible with Confluence 6.13.18 through 7.16.2)

  • Versions >= 3.0.5 (compatible with Confluence 7.16.3 and later)

For more information on how to update an app, refer to:

Updating apps | Atlassian Support | Atlassian Documentation

Fixed versions of the Questions for Confluence app stop creating the disabledsystemuser user account, and remove it from the system if it has already been created. Migrating data from the app to Confluence Cloud is now a manual process.

Option 2: Disable or delete the disabledsystemuser account

Search for the disabledsystemuser account and either disable it or delete it. For instructions on how to disable or delete an account (including an explanation of the differences between the two options), refer to:

Delete or Disable Users | Confluence Data Center and Server 7.18 | Atlassian Documentation

How To Look For Evidence of Exploitation

To determine if anyone has successfully logged in to the disabledsystemuser account, refer to the following document which provides instructions on how to get a list of users’ last logon times:

How to get a list of users with their last logon times | Confluence | Atlassian Documentation

If the last authentication time for disabledsystemuser is null, that means the account exists but no one has ever logged into it.

Need Help With This?

Give us a call, or submit a help request here. As an Atlassian Platinum Solution Partner, we’re here to help you keep all your Atlassian products running smoothly.