[HN Gopher] Hardcoded password in Confluence app has been leaked...
       ___________________________________________________________________
        
       Hardcoded password in Confluence app has been leaked on Twitter
        
       Author : duxup
       Score  : 94 points
       Date   : 2022-07-22 18:48 UTC (4 hours ago)
        
 (HTM) web link (arstechnica.com)
 (TXT) w3m dump (arstechnica.com)
        
       | PragmaticPulp wrote:
       | Note that this isn't in default Confluence installations. It
       | applies to installations that have installed the Questions for
       | Confluence plugin, which is an official Atlassian plugin.
       | 
       | The plugin page shows 8K installs when I checked:
       | https://marketplace.atlassian.com/apps/1211644/questions-for...
       | 
       | Disappointing to see this coming from an Atlassian official
       | plugin. I wonder if they outsourced this to some contractors and
       | didn't review it closely, or if they developed this in-house.
        
         | gtirloni wrote:
         | Considering all the security issues in Confluence and JIRA
         | lately, I think they have extensive expertise in this area. No
         | need to outsource.
        
       | Nextgrid wrote:
       | The password doesn't look randomly-generated, suggesting it was
       | manually generated - someone thought a hardcoded password is OK
       | in this day and age (presumably this is relatively new).
        
       | koolba wrote:
       | > To figure out if a system is vulnerable, Atlassian advised
       | Confluence users to search for accounts with the following
       | information:                   User: disabledsystemuser
       | Username: disabledsystemuser         Email:
       | dontdeletethisuser@email.com
       | 
       | Why does this even exist at all? It doesn't even seem like a
       | default admin user. Is this for automated testing and somehow
       | ended up part of the deployed codebase?
        
         | [deleted]
        
         | AdmiralAsshat wrote:
         | I'd agree, most likely part of the seed data that's needed for
         | install or bootstrapping.
        
           | gjsman-1000 wrote:
           | I have disabled users in my project as well - it works great
           | for an importer when something just doesn't quite import as a
           | resource belonging to something (flukes happen).
           | 
           | However, why is it so hard to make sure that a disabled user
           | _is actually disabled_... I mean, even just setting the
           | password to NULL would result in no possible SHA-256 hash
           | matching (and I use hashing more advanced than SHA-256 alone
           | BTW, just saying for sake of argument here). Instead, some
           | _idiot_ set the password to disabled1system1user6708 hoping
           | that nobody would ever figure it out. Which might have
           | somehow still actually worked because reversing a hash is
           | hard, had they not left it in plain text in the package.
        
         | flatiron wrote:
         | i dunno how a security audit of a staging environment wouldn't
         | pick this up. what security professional wouldn't go "hmm lets
         | see what users this thing created and their permissions" as one
         | of the top 10 things...
         | 
         | i dunno maybe i'm in the wrong field but at least i would check
         | that out.
        
           | hsbauauvhabzb wrote:
           | I'm a security auditor. I dont think many security auditors
           | think like that.
        
             | dylan604 wrote:
             | That's a really sad statement, and proves to me that
             | security audits are just another scene within the grand
             | play that is security theater
        
               | phpisthebest wrote:
               | Having been in a number of audits (it, insurance,
               | financial, etc) over the the years.... all audits are
               | theater
        
               | dylan604 wrote:
               | Yeah, but security theater is the only one that makes you
               | take all of your stuff out of your bags and then take off
               | your shoes.
        
           | resizeitplz wrote:
           | Very well could have, and then someone said "Yeah but we
           | _neeeeeed_ it "
        
           | tedunangst wrote:
           | Security audit means someone ran Nessus and checked that the
           | version strings were in the acceptable versions spreadsheet.
        
           | btown wrote:
           | I feel like many security professionals could have thought
           | "this is necessary for some internal system operation so I
           | won't touch it, and it's not like it has a hardcoded password
           | or anything" and yet it has a hardcoded password.
        
       | zricethezav wrote:
       | Good reminder to run https://gitleaks.io on your projects
        
       | staplung wrote:
       | We spend all this time inventing coding practices and even
       | languages to make our software more secure and then we're
       | reminded that even at the limit, shit like this would still be
       | happening. Sigh.
        
       | United857 wrote:
       | Now that the cat's out of the bag, might as well link to the
       | tweet: https://twitter.com/fluepke/status/1549892089181257729
        
         | prepend wrote:
         | As least the password isn't "12345."
        
           | nly wrote:
           | Hey, that's the combination on my luggage!
        
         | teddyh wrote:
         | For reference, the tweets are as follows:
         | 
         | --
         | 
         | Discovered by a fried of mine:
         | 
         | CVE-2022-26138: A remote, unauthenticated attacker with
         | knowledge of the hardcoded password could exploit this to log
         | into Confluence and access all content accessible to users in
         | the confluence-users group
         | 
         | The password is disabled1system1user6708
         | 
         | Proof: https://packages.atlassian.com/maven-atlassian-
         | external/com/...
         | 
         | Also saved to the @internetarchive just to make sure, it stays
         | online:
         | https://web.archive.org/web/20220720225515/https://d34y9yt11...
        
         | AdamTReineke wrote:
         | Yeah, this was the initial discovery/disclosure tweet, as far
         | as I know. Notice it was posted two days ago, same as the
         | announcement from Atlassian.
        
       | wkdneidbwf wrote:
       | audits, soc 2, and all the other bs hoops the industry jumps
       | through... for what?
       | 
       | when stuff like this exists it's pretty clear that large
       | enterprises' idea of security and risk management is all made up
       | to sound good and lacks teeth.
        
         | doctor_eval wrote:
         | Well I was forced to add password rotation to an enterprise
         | product by a large enterprise user only a couple of years ago
         | despite password rotation being rejected by research for a
         | decade and no longer recommended even by Microsoft. So, yeah.
         | Like most enterprise stuff it's all just a bunch of
         | boilerplate.
        
         | throwawaysleep wrote:
         | I work for a security company that helps with the audit
         | process.
         | 
         | Nobody on my team can tell you the first thing about SOC 2. It
         | is an external selling point, not something actually adopted by
         | the org.
        
       ___________________________________________________________________
       (page generated 2022-07-22 23:01 UTC)