#VU65739 Embedded malicious code (backdoor) in Questions for Confluence - CVE-2022-26138

Description

The vulnerability allows a remote attacker to gain unauthorized access to the application.

The vulnerability exists due to presence of a hardcoded disabledsystemuser account after installing the affected version of Questions for Confluence app. A remote attacker can login to the Confluence Server or Confluence Data Center instance using the hardcoded credentials and compromise the instance.

Note, the account is not removed from the system after app removal. Therefore, if the affected version of Questions for Confluence app was previously installed and later removed, the backdoor account remains active on the system.

There is a high chance the vulnerability is being actively exploited in the wild due to public vulnerability disclosure.

Remediation

External links

• https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html
• https://jira.atlassian.com/browse/CONFSERVER-79483