Atlassian discloses critical vulnerability in Confluence Server

guest · Aug 29, 2019

Update now: Atlassian discloses critical vulnerability in Confluence Server
August 28, 2019
https://siliconangle.com/2019/08/28...ses-critical-vulnerability-confluence-server/

Atlassian Corp. Plc Wednesday warned customers of its popular Confluence collaboration software program to urgently update their installations following the discovery of a critical vulnerability that can allow an attacker to gain access and steal data.

The security advisory affects all versions of Confluence Server and Confluence Data Center from 6.1.0 before 6.6.16, 6.7.0 before 6.13.7 and from 6.14.0 before 6.15.8.

CVE-2019-3394, as it’s called, is described as a file disclosure vulnerability in the page export function. “A remote attacker who has Add Page space permission would be able to read arbitrary files in the /confluence/WEB-INF directory, which may contain configuration files used for integrating with other services, potentially leaking credentials, such as LDAP credentials, or other sensitive information,” the advisory reads.
Click to expand...

guest · Aug 26, 2021

Atlassian warns of critical Confluence flaw
9.8-rated bug allows arbitrary code execution – possibly without authentication
August 26, 2021
https://www.theregister.com/2021/08/26/atlassian_critical_confluence_flaw/

Atlassian has warned users of its Confluence Server that they need to patch the product to remedy a Critical-rated flaw.

The company's not saying a lot about CVE-2021-26084, besides describing it as a "Confluence Server Webwork OGNL injection vulnerability … that would allow an authenticated user, and in some instances unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance."
Click to expand...

The bug scores 9.8 on the ten-point Common Vulnerability Scoring System.

Atlassian has released fixed versions of the product – namely versions 6.13.23, 7.4.11, 7.11.6, 7.12.5, and 7.13.0 – but the company's advisory suggests upgrading to the latest long-term service release.
Atlassian's advisory notes that a full upgrade is not possible for all users, so they need to step up to the clean double-point versions mentioned above before contemplating the step to version 7.13.
Click to expand...

guest · Sep 22, 2021

This cryptocurrency miner is exploiting the new Confluence remote code execution bug
It didn't take long for CVE-2021-26084 to be added to exploit kits.
September 22, 2021
https://www.zdnet.com/article/this-...the-new-confluence-remote-code-execution-bug/

The z0Miner cryptojacker is now weaponizing a new Confluence vulnerability to mine for cryptocurrency on vulnerable machines.

Trend Micro researchers said on Tuesday that the cryptocurrency mining malware is now exploiting a recently-disclosed Atlassian Confluence remote code execution (RCE) vulnerability, which was only made public in August this year.
Tracked as CVE-2021-26084, the vulnerability impacts Confluence server versions 6.6.0, 6.13.0, 7.4.0, and 7.12.0.
Click to expand...

guest · Sep 28, 2021

Atlassian Confluence RCE Flaw Abused in Multiple Cyberattack Campaigns
September 28, 2021
https://thehackernews.com/2021/09/atlassian-confluence-rce-flaw-abused-in.html

Opportunistic threat actors have been found actively exploiting a recently disclosed critical security flaw in Atlassian Confluence deployments across Windows and Linux to deploy web shells that result in the execution of crypto miners on compromised systems.

Tracked as CVE-2021-26084 (CVSS score: 9.8), the vulnerability concerns an OGNL (Object-Graph Navigation Language) injection flaw that could be exploited to achieve arbitrary code execution on a Confluence Server or Data Center instance.

"A remote attacker can exploit this vulnerability by sending a crafted HTTP request containing a malicious parameter to a vulnerable server," researchers from Trend Micro noted in a technical write-up detailing the weakness. "Successful exploitation can result in arbitrary code execution in the security context of the affected server."
The in-the-wild attacks come after the U.S. Cyber Command warned of mass exploitation attempts following the vulnerability's public disclosure in late August this year.
Click to expand...

"As is often the case with RCE vulnerabilities, attackers will rush and exploit affected systems for their own gain," Imperva researchers said. "RCE vulnerabilities can easily allow threat actors to exploit affected systems for easy monetary gain by installing crypto currency miners and masking their activity, thus abusing the processing resources of the target."
Click to expand...

guest · Oct 4, 2021

New Atom Silo ransomware targets vulnerable Confluence servers
October 4, 2021
https://www.bleepingcomputer.com/ne...omware-targets-vulnerable-confluence-servers/

Atom Silo, a newly spotted ransomware group, is targeting a recently patched and actively exploited Confluence Server and Data Center vulnerability to deploy their ransomware payloads.

On August 25, Atlassian issued security updates to patch a Confluence remote code execution (RCE) vulnerability tracked as CVE-2021-26084 and exploited in the wild.
Successful exploitation enables unauthenticated attackers to execute commands on unpatched servers remotely.
Click to expand...

Ransomware gangs start targeting Confluence servers
The discovery was made by SophosLabs researchers while investigating a recent incident. They also found that the ransomware used by this new group is almost identical to LockFile, which is itself very similar to the one used by the LockBit ransomware group.

However, Atom Silo operators use "several novel techniques that made it extremely difficult to investigate, including the side-loading of malicious dynamic-link libraries tailored to disrupt endpoint protection software."
Click to expand...

Ransomware payloads deployed by Atom Silo also come with a malicious kernel driver used to disrupt endpoint protection solutions and evade detection.

"The incident investigated by Sophos shows how quickly the ransomware landscape can evolve. This ultra-stealthy adversary was unknown until a few weeks ago," said Sean Gallagher, a senior threat researcher at Sophos.
"While similar to another recently discovered ransomware group, LockFile, Atom Silo has emerged with its own bag of novel and sophisticated tactics, techniques and procedures that were full of twists and turns and challenging to spot – probably intentionally so.
Further technical details on Atom Silo's compromise and lateral movement tactics can be found in SophosLabs' report.
Click to expand...

SophosLabs: Atom Silo ransomware actors use Confluence exploit, DLL side-load for stealthy attack

The initial point of compromise in this attack was a vulnerability that was only public for about three weeks at the time. For many organizations, keeping up with the pace of patching can be a challenge in the best of times—and the effects of lock-down and other recent stressors affecting staff availability are only making keeping up with patches more difficult.
Click to expand...

guest · Jul 20, 2022

Atlassian fixes critical Confluence hardcoded credentials flaw
July 20, 2022

Atlassian has patched a critical hardcoded credentials vulnerability in Confluence Server and Data Center that could let remote, unauthenticated attackers log into vulnerable, unpatched servers.

The hardcoded password is added after installing the Questions for Confluence app (versions 2.7.34, 2.7.35, and 3.0.2) for a user account with the username disabledsystemuser — designed to help admins with the migration of data from the app to the Confluence Cloud.
According to Atlassian, the app helps improve communication with the organization's internal Q&A team and is currently installed on over 8,000 Confluence servers.
Click to expand...

"The disabledsystemuser account is created with a hardcoded password and is added to the confluence-users group, which allows viewing and editing all non-restricted pages within Confluence by default," the company explained in a security advisory published on Wednesday.

Atlassian says it has no evidence and is yet to receive reports that the vulnerability (tracked as CVE-2022-26138) is being exploited in the wild.
Click to expand...

To disable or delete the account, you can use the detailed steps provided in this support document.
Click to expand...

guest · Jul 22, 2022

Hardcoded password in Confluence app has been leaked on Twitter
Advisory had already warned hardcoded password was "trivial to obtain."
July 22, 2022

What's worse than a widely used Internet-connected enterprise app with a hardcoded password? Try said enterprise app after the hardcoded password has been leaked to the world.

Atlassian on Wednesday revealed three critical product vulnerabilities, including CVE-2022-26138 stemming from a hardcoded password in Questions for Confluence, an app that allows users to quickly receive support for common questions involving Atlassian products. The company warned the passcode was "trivial to obtain."
Click to expand...

A day later, Atlassian was back to report that "an external party has discovered and publicly disclosed the hardcoded password on Twitter," leading the company to ratchet up its warnings.

"This issue is likely to be exploited in the wild now that the hardcoded password is publicly known," the updated advisory read. "This vulnerability should be remediated on affected systems immediately."
Click to expand...

Vulnerable Confluence servers have long been a favorite opening for hackers looking to install ransomware, cryptominers, and other forms of malware. The vulnerabilities Atlassian disclosed this week are serious enough that admins should prioritize a thorough review of their systems, ideally before the weekend starts.
Click to expand...

Freki123 · Jul 23, 2022

To make it even more brilliant, they seem to not even own the email they hard coded in.
https://twitter.com/fluepke/status/1550471087560982531
The email is mentioned here:
https://confluence.atlassian.com/do...-security-advisory-2022-07-20-1142446709.html

Source (german blog):
https://blog.fefe.de/

guest · Jul 28, 2022

Exploitation of Recent Confluence Vulnerability Underway
July 28, 2022

Questions for Confluence is an application designed to help Confluence users obtain information, share information with others, and to seek counsel from experts when necessary.

Tracked as CVE-2022-26138 and considered ‘critical severity’, the issue exists because, when enabled on Confluence Server and Data Center, the Questions for Confluence application creates a user account with a hardcoded password.
Click to expand...

Exploitation of CVE-2022-26138 is now underway and it seems that some attack attempts were observed even before Atlassian issued its warning.

“Unsurprisingly, it didn’t take long for Rapid7 to observe exploitation once the hardcoded credentials were released, given the high value of Confluence for attackers who often jump on Confluence vulnerabilities to execute ransomware attacks,” Rapid7 said on Wednesday.
Shadowserver and Grey Noise have also observed in-the-wild exploitation of the security flaw.
Click to expand...

guest · Aug 4, 2022

Hackers Exploited Atlassian Confluence Bug to Deploy Ljl Backdoor for Espionage
August 4, 2022

A threat actor is said to have "highly likely" exploited a security flaw in an outdated Atlassian Confluence server to deploy a never-before-seen backdoor against an unnamed organization in the research and technical services sector.

The attack, which transpired over a seven-day-period during the end of May, has been attributed to a threat activity cluster tracked by cybersecurity firm Deepwatch as TAC-040.

"The evidence indicates that the threat actor executed malicious commands with a parent process of tomcat9.exe in Atlassian's Confluence directory," the company said. "After the initial compromise, the threat actor ran various commands to enumerate the local system, network, and Active Directory environment."
The Atlassian vulnerability suspected to have been exploited is CVE-2022-26134, an Object-Graph Navigation Language (OGNL) injection flaw that paves the way for arbitrary code execution on a Confluence Server or Data Center instance.
Click to expand...

Not much is known about TAC-040 other than the fact that the adversarial collective's goals could be espionage-related, although the possibility that the group could have acted out of financial gain hasn't been ruled out, citing the presence of a loader for an XMRig crypto miner on the system.
Click to expand...

Log in or Sign up

Atlassian discloses critical vulnerability in Confluence Server

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Freki123 Registered Member

guest Guest

guest Guest

Log in or Sign up

Atlassian discloses critical vulnerability in Confluence Server

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Freki123 Registered Member

guest Guest

guest Guest

Useful Searches