Threat Signal Report

New Confluence Vulnerability (CVE-2022-26134) Exploited in the Wild

Description

UPDATE June 5th 2022: Added IPS coverage to the protection section. A link to Outbreak Alert was added to the Appendix.

FortiGuard Labs is aware of a new vulnerability in Confluence Server and Data Center (CVE-2022-26134) which was reportedly exploited as a zero-day in the wild. Rated critical, successful exploitation of the vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the compromised server. The vulnerability affects all supported versions of unpatched Confluence Server and Data Center.

Why is this Significant?

This is significant because Confluence Server and Data Center (CVE-2022-26134) was reportedly exploited as a 0-day in the wild. The vulnerability is an OGNL injection vulnerability that allows an unauthenticated remote attacker to execute arbitrary code on the compromised server.

Confluence is a widely-used team workspace and collaboration tool developed by Atlassian. It is used to help teams collaborate and share knowledge via a content management system and is used by many large scale enterprise and organizations worldwide. This vulnerability does not have a CVSS score at the moment, but the ease of exploitation via an unauthenticated session and combined with remote code execution is a cause for concern.

What versions of Confluence Server and Data Center are Affected by CVE-2022-26134?

The advisory released by Atlassian states that the following versions are affected:

All supported versions of Confluence Server and Data Center
Confluence Server and Data Center versions after 1.3.0

What Malware were Deployed to the Compromised Server?

It was reported that China Chopper and a custom file upload shell have been deployed on to compromised servers. China Chopper is a tiny webshell that provides a remote attacker backdoor access to a compromised system.

Has the Vendor Released an Advisory for CVE-2022-26134?

Yes. See the Appendix for a link to "Confluence Security Advisory 2022-06-02".

Has the Vendor Released a Patch?

Yes, Atlassian has released a patch on June 3rd, 2022.

What is the Status of Coverage?

FortiGuard Labs provides the following AV coverage against the China Chopper webshell and the custom file upload shell that were reportedly deployed on known compromised Confluence servers:

Java/Websh.D!tr
HTML/Agent.D71B!tr

FortiGuard Labs released the following IPS signature in version 21.331:

Atlassian.Confluence.OGNL.Remote.Code.Execution (deafult action is set to Pass)

All known network IOC's associated with attacks leveraging CVE-2022-26134 are blocked by the FortiGuard WebFiltering Client.

Any Suggested Mitigation?

The advisory includes mitigation information. See the Appendix for a link to "Confluence Security Advisory 2022-06-02".

Outbreak Alert

A critical 0-day vulnerability on Atlassian Confluence Data Center and Server is actively being exploited in the wild. The vulnerability is established via the Object Graph Navigation Language (OGNL) injection that allows an unauthenticated user to execute arbitrary code.

View the full Outbreak Alert Report