Active Exploitation of Atlassian Vulnerabilities

Exploitation is underway for one of the trio of critical Atlassian vulnerabilities that were published last week, affecting several of the company’s on-premises products, according to Rapid7. Atlassian has been a focus for attackers, as it was less than two months ago that Rapid7 observed exploitation of a vulnerability in Confluence Server and Confluence Data Center.

The most critical of the three vulnerabilities was quickly exploited in the wild once the hard-coded password was released on social media, according to Rapid7’s blog. This vulnerability only exists when the Questions for Confluence app is enabled and does not impact the Confluence Cloud instance. Once the app is enabled on affected versions, it will create a user account with a hard-coded password and add the account to a user group, which allows access to all non-restricted pages in Confluence. This allows a remote, unauthenticated attacker to browse an organization’s Confluence instance.

It didn’t take long for Rapid7 to observe exploitation once the hard-coded credentials were released, given the high value of Confluence for attackers who often jump on Confluence vulnerabilities to execute ransomware attacks.

Mike Parkin is senior technical engineer at Vulcan Cyber.

“When the hard-coded password vulnerability on Atlassian’s Confluence Server was revealed, many security professionals, myself included, recommended patching as soon as possible because this was something threat actors were going to start leveraging immediately,” he said. “Seeing them go after this vulnerability in the wild now is exactly what was expected. If you have already patched, great. Still check to make sure it wasn’t exploited before the patch. If you haven’t patched, do so, now.”

Rick Holland is CISO and vice president of strategy at Digital Shadows.

“Confluence has had no shortage of headlines,” he said. “Unfortunately, this isn’t a software vulnerability, but a conscious decision to hard-code a password for ease of use. Hard-coded passwords significantly increase the likelihood of exploitation, especially when the passwords become widely shared. If you play soccer, hard-coded passwords are own goals. Adversaries score enough goals alone. We don’t need to put the ball in our own net. Never use hard-coded passwords. Take the time to set up proper authentication and minimize future risks.”