Questions for Confluence App Default Credentials (CVE-2022-26138)

##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(164091);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/06/05");

  script_cve_id("CVE-2022-26138");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2022/08/19");

  script_name(english:"Questions for Confluence App Default Credentials (CVE-2022-26138)");

  script_set_attribute(attribute:"synopsis", value:
"The application hosted on the remote web server uses a default set of known credentials.");
  script_set_attribute(attribute:"description", value:
"The remote confluence web application uses a known set of hard-coded default credentials of the
'Questions for Confluence' marketplace application. An attacker can exploit this to gain 
administrative access to the remote host.");
  # https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?56edf34e");
  script_set_attribute(attribute:"solution", value:
"Change the application's default credentials.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-26138");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/07/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/07/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/08/12");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:atlassian:confluence");
  script_set_attribute(attribute:"default_account", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("confluence_detect.nasl");
  script_require_keys("installed_sw/confluence");
  script_exclude_keys("Settings/disable_cgi_scanning");
  script_require_ports("Services/www", 8080, 8090);

  exit(0);
}

include('http.inc');
include('url_func.inc');
include('vcf.inc');
include('debug.inc');

var app_name = 'confluence';
var port     = get_http_port(default:80);
var app_info = vcf::get_app_info(app:app_name, port:port, webapp:true);
var url      = build_url(port:port, qs:app_info['path']);

##
# Try to authenticate with default disabledsystemuser/disabled1system1user6708 creds
#
# @param port - the port the application exists on
# @return TRUE for successful authentication, otherwise FALSE
##
function try_default_creds(port)
{
  dbg::detailed_log(lvl:1, src:FUNCTION_NAME, msg:'[trying default creds]');
  var res, post;
  post = 'os_username=disabledsystemuser&os_password=disabled1system1user6708&login=Log+in&os_destination=%2Findex.action';
  # Authenticate
  res = http_send_recv3(
    port         : port,
    method       : 'POST',
    item         : '/dologin.action',
    data         : post,
    content_type : "application/x-www-form-urlencoded",
    exit_on_fail : TRUE
  );

  dbg::detailed_log(lvl:1, src:FUNCTION_NAME, msg:'Attempted to login with: ' + http_last_sent_request());
  dbg::detailed_log(lvl:1, src:FUNCTION_NAME, msg:'Response was: ' + obj_rep(res));
  if ('HTTP/1.1 302' >< res[0] && 'X-Seraph-LoginReason: OK' >< res[1])
  {
    dbg::detailed_log(lvl:1, src:FUNCTION_NAME, msg:'[login confirmed][ ' + res[0] + '][' + res[1] + ']');
    return TRUE;
  }
  dbg::detailed_log(lvl:1, src:FUNCTION_NAME, msg:'[login failed][ ' + res[0] + '][' + res[1] + ']');
  return FALSE;
}

var can_auth = try_default_creds(port:port);

var report = NULL;
if (can_auth)
{
  report = 'Nessus was able to gain access to the remote confluence app\n' +
            'using the following set of credentials:\n' +
            '\n  Username : disabledsystemuser' +
            '\n  Password : disabled1system1user6708';

  security_report_v4(port:port, severity:SECURITY_HOLE, extra:report);
}
else audit(AUDIT_WEB_APP_NOT_AFFECTED, app_name, url);