3 ms·

Now that the cat's out of the bag, might as well link to the tweet: https://twitter.com/fluepke/status/1549892089181257729 https://twitter.com/fluepke/status/15

Now that the cat's out of the bag, might as well link to the tweet: https://twitter.com/fluepke/status/1549892089181257729 https://twitter.com/fluepke/status/1549892089181257729

prepend 4y ago
As least the password isn’t “12345.”
- nly 4y ago
  Hey, that's the combination on my luggage!
teddyh 4y ago
For reference, the tweets are as follows: -- Discovered by a fried of mine: CVE-2022-26138: A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group The password is disabled1system1user6708 Proof: https://packages.atlassian.com/maven-atlassian-external/com/atlassian/confluence/plugins/confluence-questions/3.0.2/confluence-questions-3.0.2.jar https://packages.atlassian.com/maven-atlassian-external/com/... Also saved to the @internetarchive just to make sure, it stays online: https://web.archive.org/web/20220720225515/https://d34y9yt11qeow3.cloudfront.net/filestore/0d/0de9e967a46863b23fd381d1929c5a6351f1cbfc?response-content-type=application%2Fjava-archive&response-content-disposition=attachment%3B%20filename%3D%22confluence-questions-3.0.2.jar%22%3B%20filename%2A%3DUTF-8%27%27confluence-questions-3.0.2.jar&Expires=1658358314&Signature=ItPkOeFqDm5xROxtxThsVYp~fow08JnHJXQDaCu7~QrIxkbF3VcBmh8mCnJoZkIYi0zJQBCRUC2fR3yHJOFGl8yhUdg5S89HkQwHBRuIPkzflUXFEXgTs6ANCL3Yylj6kj~9BUxLegCKeCy1sdlJEQi9~gJOgoglg91j0dMTRjcXUD7b0xbohNswLjvVjPX~aWbt04293Vx1lQrL~4-cPbkbL7npgXMrgP-vUT-FIJ47RbEwHZOozw9c6HnwUcxaByDCyiEySEbOwYFNcsP6ptoV3fe2iewO00QeURXrNLFF7Nb7GzhP1J~oRwZffwB12uPaVfXEhRorCdO9Qzdu6w__&Key-Pair-Id=APKAIJLYLBQB5QQNWHHQ https://web.archive.org/web/20220720225515/https://d34y9yt11...
AdamTReineke 4y ago
Yeah, this was the initial discovery/disclosure tweet, as far as I know. Notice it was posted two days ago, same as the announcement from Atlassian.
United857 4y ago
A pet peeve of mine is when news articles cite public sources like social media but don't bother to link to them. I can understand for NSFW content but that should be the exception not the rule!
- motoxpro 4y ago
  Why would you want them to give publicity to a description on how to exploit something? At least when you don't publish the "hack" you can let people know to take action without trivializing the exploit. Yes, I know it's still trivial to find it by searching Twitter.
  - HelloNurse 4y ago
    It's a matter of responsible disclosure. Increased terror causes increased publicity, causing more systems to be fixed, and pushes more people to take urgent action against the vulnerabilities. Your PHB cannot say "hackers would need a password, don't worry".
    - leaflets2 4y ago
      What's PHB?
      - HelloNurse 4y ago
        The Pointy Haired Boss is the main "villain" in the Dilbert comic strip by Scott Adams.

Now that the cat's out of the bag, might as well link to the tweet: https://twitter.com/fluepke/status/1549892089181257729 https://twitter.com/fluepke/status/1549892089181257729

prepend 4y ago

As least the password isn’t “12345.”

nly 4y ago
Hey, that's the combination on my luggage!

teddyh 4y ago

For reference, the tweets are as follows: -- Discovered by a fried of mine: CVE-2022-26138: A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group The password is disabled1system1user6708 Proof: https://packages.atlassian.com/maven-atlassian-external/com/atlassian/confluence/plugins/confluence-questions/3.0.2/confluence-questions-3.0.2.jar https://packages.atlassian.com/maven-atlassian-external/com/... Also saved to the @internetarchive just to make sure, it stays online: https://web.archive.org/web/20220720225515/https://d34y9yt11qeow3.cloudfront.net/filestore/0d/0de9e967a46863b23fd381d1929c5a6351f1cbfc?response-content-type=application%2Fjava-archive&response-content-disposition=attachment%3B%20filename%3D%22confluence-questions-3.0.2.jar%22%3B%20filename%2A%3DUTF-8%27%27confluence-questions-3.0.2.jar&Expires=1658358314&Signature=ItPkOeFqDm5xROxtxThsVYp~fow08JnHJXQDaCu7~QrIxkbF3VcBmh8mCnJoZkIYi0zJQBCRUC2fR3yHJOFGl8yhUdg5S89HkQwHBRuIPkzflUXFEXgTs6ANCL3Yylj6kj~9BUxLegCKeCy1sdlJEQi9~gJOgoglg91j0dMTRjcXUD7b0xbohNswLjvVjPX~aWbt04293Vx1lQrL~4-cPbkbL7npgXMrgP-vUT-FIJ47RbEwHZOozw9c6HnwUcxaByDCyiEySEbOwYFNcsP6ptoV3fe2iewO00QeURXrNLFF7Nb7GzhP1J~oRwZffwB12uPaVfXEhRorCdO9Qzdu6w__&Key-Pair-Id=APKAIJLYLBQB5QQNWHHQ https://web.archive.org/web/20220720225515/https://d34y9yt11...

AdamTReineke 4y ago

Yeah, this was the initial discovery/disclosure tweet, as far as I know. Notice it was posted two days ago, same as the announcement from Atlassian.

United857 4y ago

A pet peeve of mine is when news articles cite public sources like social media but don't bother to link to them. I can understand for NSFW content but that should be the exception not the rule!

motoxpro 4y ago
Why would you want them to give publicity to a description on how to exploit something? At least when you don't publish the "hack" you can let people know to take action without trivializing the exploit. Yes, I know it's still trivial to find it by searching Twitter.
- HelloNurse 4y ago
  It's a matter of responsible disclosure. Increased terror causes increased publicity, causing more systems to be fixed, and pushes more people to take urgent action against the vulnerabilities. Your PHB cannot say "hackers would need a password, don't worry".
  - leaflets2 4y ago
    What's PHB?
    - HelloNurse 4y ago
      The Pointy Haired Boss is the main "villain" in the Dilbert comic strip by Scott Adams.