We would like to bring to your attention the recently discovered unauthenticated remote code execution vulnerability in Atlassian Confluence (CVE-2022-26134).
Description
Confluence Server and Data Center editions are affected by the unauthenticated remote code execution flaw and are currently under active exploitation by malicious hacker groups. At the time of writing no specifics about the vulnerable endpoint have been released.
Affected Versions
As confirmed by Atlassian, all supported versions of Confluence Server and Data Center are affected.
Note: Confluence sites hosted at the Atlassian Cloud are protected against the exploitation. If your site is accessed via an .atlassian.net domain, it is hosted at the Atlassian Cloud.
Remediation
Currently there is no security patch available. Atlassian advises customers to remove Confluence Server and Data Center from the internet until a security patch becomes available for the mentioned issue.
If you are unable to remove the application from the internet, either through disabling the server or adding firewall rules, implementing a Web Application Firewall rule which blocks URLS containing ${ may reduce your risk of exploitation.
When will a security patch become available?
A deadline for remediation has been set for June 3rd, 2022 by the United States Cybersecurity & Infrastructure Security Agency (CISA).
Atlassian states “We expect that security fixes for supported versions of Confluence will begin to be available for customer download within 24 hours (estimated time, by EOD June 3 PDT).”
References:
-
https://bugalert.org/content/notices/2022-06-02-confluence.html?src=tw
-
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
-
https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/
-
https://thehackernews.com/2022/06/hackers-exploiting-unpatched-critical.html
Cybersecurity Glossary
Read this comprehensive list we’ve compiled to assist experts, C-level executives, and those embarking on a cybersecurity career in navigating the extensive array of terms in…
An In-Depth Guide to Remote Desktop Protocol (RDP)
The continually changing nature of today’s workplace has made remote access technology essential.
Mitigating Credential Stuffing Attacks with IP Rotation: Strategies and Considerations
This article covers effective strategies to fight credential-stuffing attacks using IP rotation. By Ibai Castells
CovertSwarm at DEF CON 32: Insights from the Swarm
This time last week, our Swarm was taking over Las Vegas at DEF CON 32 – one of the biggest and oldest hacker conventions in the…