[HN Gopher] Hardcoded password in Confluence app has been leaked...
___________________________________________________________________
Hardcoded password in Confluence app has been leaked on Twitter
Author : duxup
Score : 94 points
Date : 2022-07-22 18:48 UTC (4 hours ago)
(HTM) web link (arstechnica.com)
(TXT) w3m dump (arstechnica.com)
| PragmaticPulp wrote:
| Note that this isn't in default Confluence installations. It
| applies to installations that have installed the Questions for
| Confluence plugin, which is an official Atlassian plugin.
|
| The plugin page shows 8K installs when I checked:
| https://marketplace.atlassian.com/apps/1211644/questions-for...
|
| Disappointing to see this coming from an Atlassian official
| plugin. I wonder if they outsourced this to some contractors and
| didn't review it closely, or if they developed this in-house.
| gtirloni wrote:
| Considering all the security issues in Confluence and JIRA
| lately, I think they have extensive expertise in this area. No
| need to outsource.
| Nextgrid wrote:
| The password doesn't look randomly-generated, suggesting it was
| manually generated - someone thought a hardcoded password is OK
| in this day and age (presumably this is relatively new).
| koolba wrote:
| > To figure out if a system is vulnerable, Atlassian advised
| Confluence users to search for accounts with the following
| information: User: disabledsystemuser
| Username: disabledsystemuser Email:
| dontdeletethisuser@email.com
|
| Why does this even exist at all? It doesn't even seem like a
| default admin user. Is this for automated testing and somehow
| ended up part of the deployed codebase?
| [deleted]
| AdmiralAsshat wrote:
| I'd agree, most likely part of the seed data that's needed for
| install or bootstrapping.
| gjsman-1000 wrote:
| I have disabled users in my project as well - it works great
| for an importer when something just doesn't quite import as a
| resource belonging to something (flukes happen).
|
| However, why is it so hard to make sure that a disabled user
| _is actually disabled_... I mean, even just setting the
| password to NULL would result in no possible SHA-256 hash
| matching (and I use hashing more advanced than SHA-256 alone
| BTW, just saying for sake of argument here). Instead, some
| _idiot_ set the password to disabled1system1user6708 hoping
| that nobody would ever figure it out. Which might have
| somehow still actually worked because reversing a hash is
| hard, had they not left it in plain text in the package.
| flatiron wrote:
| i dunno how a security audit of a staging environment wouldn't
| pick this up. what security professional wouldn't go "hmm lets
| see what users this thing created and their permissions" as one
| of the top 10 things...
|
| i dunno maybe i'm in the wrong field but at least i would check
| that out.
| hsbauauvhabzb wrote:
| I'm a security auditor. I dont think many security auditors
| think like that.
| dylan604 wrote:
| That's a really sad statement, and proves to me that
| security audits are just another scene within the grand
| play that is security theater
| phpisthebest wrote:
| Having been in a number of audits (it, insurance,
| financial, etc) over the the years.... all audits are
| theater
| dylan604 wrote:
| Yeah, but security theater is the only one that makes you
| take all of your stuff out of your bags and then take off
| your shoes.
| resizeitplz wrote:
| Very well could have, and then someone said "Yeah but we
| _neeeeeed_ it "
| tedunangst wrote:
| Security audit means someone ran Nessus and checked that the
| version strings were in the acceptable versions spreadsheet.
| btown wrote:
| I feel like many security professionals could have thought
| "this is necessary for some internal system operation so I
| won't touch it, and it's not like it has a hardcoded password
| or anything" and yet it has a hardcoded password.
| zricethezav wrote:
| Good reminder to run https://gitleaks.io on your projects
| staplung wrote:
| We spend all this time inventing coding practices and even
| languages to make our software more secure and then we're
| reminded that even at the limit, shit like this would still be
| happening. Sigh.
| United857 wrote:
| Now that the cat's out of the bag, might as well link to the
| tweet: https://twitter.com/fluepke/status/1549892089181257729
| prepend wrote:
| As least the password isn't "12345."
| nly wrote:
| Hey, that's the combination on my luggage!
| teddyh wrote:
| For reference, the tweets are as follows:
|
| --
|
| Discovered by a fried of mine:
|
| CVE-2022-26138: A remote, unauthenticated attacker with
| knowledge of the hardcoded password could exploit this to log
| into Confluence and access all content accessible to users in
| the confluence-users group
|
| The password is disabled1system1user6708
|
| Proof: https://packages.atlassian.com/maven-atlassian-
| external/com/...
|
| Also saved to the @internetarchive just to make sure, it stays
| online:
| https://web.archive.org/web/20220720225515/https://d34y9yt11...
| AdamTReineke wrote:
| Yeah, this was the initial discovery/disclosure tweet, as far
| as I know. Notice it was posted two days ago, same as the
| announcement from Atlassian.
| wkdneidbwf wrote:
| audits, soc 2, and all the other bs hoops the industry jumps
| through... for what?
|
| when stuff like this exists it's pretty clear that large
| enterprises' idea of security and risk management is all made up
| to sound good and lacks teeth.
| doctor_eval wrote:
| Well I was forced to add password rotation to an enterprise
| product by a large enterprise user only a couple of years ago
| despite password rotation being rejected by research for a
| decade and no longer recommended even by Microsoft. So, yeah.
| Like most enterprise stuff it's all just a bunch of
| boilerplate.
| throwawaysleep wrote:
| I work for a security company that helps with the audit
| process.
|
| Nobody on my team can tell you the first thing about SOC 2. It
| is an external selling point, not something actually adopted by
| the org.
___________________________________________________________________
(page generated 2022-07-22 23:01 UTC)