cbcvebase.
CVE-2022-26134
published 2022-06-03

CVE-2022-26134: In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute…

PriorityP1100critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2022-06-06
Exploited in the wild
EPSS
100.00%
100.0th percentile
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

Affected

42 ranges· showing 25
VendorProductVersion rangeFixed in
atlassianconfluence_data_center
atlassianconfluence_data_center>= 1.3 < 7.4.177.4.17
atlassianconfluence_data_center>= 7.13.0 < unspecifiedunspecified
atlassianconfluence_data_center>= 7.13.0 < 7.13.77.13.7
atlassianconfluence_data_center>= 7.14.0 < unspecifiedunspecified
atlassianconfluence_data_center>= 7.14.0 < 7.14.37.14.3
atlassianconfluence_data_center>= 7.15.0 < unspecifiedunspecified
atlassianconfluence_data_center>= 7.15.0 < 7.15.27.15.2
atlassianconfluence_data_center>= 7.16.0 < unspecifiedunspecified
atlassianconfluence_data_center>= 7.16.0 < 7.16.47.16.4
atlassianconfluence_data_center>= 7.17.0 < unspecifiedunspecified
atlassianconfluence_data_center>= 7.17.0 < 7.17.47.17.4
atlassianconfluence_data_center>= 7.18.0 < unspecifiedunspecified
atlassianconfluence_data_center>= next of 1.3.0 < unspecifiedunspecified
atlassianconfluence_data_center>= unspecified < 7.4.177.4.17
atlassianconfluence_data_center>= unspecified < 7.13.77.13.7
atlassianconfluence_data_center>= unspecified < 7.14.37.14.3
atlassianconfluence_data_center>= unspecified < 7.15.27.15.2
atlassianconfluence_data_center>= unspecified < 7.16.47.16.4
atlassianconfluence_data_center>= unspecified < 7.17.47.17.4
atlassianconfluence_data_center>= unspecified < 7.18.17.18.1
atlassianconfluence_server
atlassianconfluence_server>= 1.3 < 7.4.177.4.17
atlassianconfluence_server>= 7.13.0 < unspecifiedunspecified
atlassianconfluence_server>= 7.13.0 < 7.13.77.13.7

Detection & IOCsextracted from sources · hover to see the quote

filenamero.sh
filenameap.sh
filenameldr.sh
filenameko
urlhttps://www.shodan.io/search?query=http.favicon.hash%3A-305179312
otherdisabledsystemuser / disabled1system1user6708
snort
SIDs: 59925-59934
  • The exploit is delivered via a specially crafted HTTP request URI containing an OGNL expression; all HTTP methods are vulnerable. Monitor HTTP requests to Confluence for OGNL expressions embedded in the URI path.
  • 90% of observed exploit requests match Rapid7 PoC parameters, including reference to a Java package and setting the X-Cmd-Response header. Use this as a high-confidence detection pattern.
  • Post-exploitation: detect iptables being flushed or firewall policy set to ACCEPT by child processes of the Confluence JVM, indicating malware attempting to disable host-based firewall.
  • Post-exploitation lateral movement: monitor for SSH credential harvesting from .ssh directories and .bash_history files under /root and /home, spawned from the Confluence process.
  • ·Disabling anonymous access to Confluence does NOT mitigate CVE-2022-26134; the vulnerability is exploitable by unauthenticated attackers regardless of this setting.
  • ·Uninstalling the Questions for Confluence app does NOT remove the hardcoded 'disabledsystemuser' account; the account must be manually disabled or deleted to remediate CVE-2022-26138.
  • ·All supported versions of Confluence Server and Data Center are affected; versions as old as 1.0.3 are vulnerable to CVE-2022-26134.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.