Atlassian Confluence Zero-day Vulnerability (0-Zero) CVE-2022-26134: What You Need To Know

[Will_G]

Introduction

Volexity, industry-leading incident response and forensics firm based out of Reston, Virginia, U.S.A.,  identified a new zero-day (0-day) vulnerability in Atlassian’s Confluence Server software during an engagement over the Memorial Day holiday weekend. Their investigation found that an attacker had been able to successfully launch an exploit against the previously undocumented 0-day resulting in remote code execution (RCE) within the victim environment. The Volexity team was able to recreate a Proof of Concept (PoC) successfully along with a report that described the 0-day vulnerability in detail which included an up-to-date list of affected versions of Atlassian’s Confluence Server and Data Center software. Volexity dutifully contacted the vendor on May 31, 2022, provided their PoC and report and were the first party to receive confirmation of the 0-day[i] by Atlassian, which has since been designated as CVE-2022-26134 by MITRE. For more information see Volexity’s blog[ii] and the respective MITRE entry for CVE-2022-26134[iii].

Affected Versions of Atlassian Server and Data Center Software

The following versions of Atlassian Server and Data Center Software[iv] have been proven to be affected by the CVE-2022-26134 and are deemed vulnerable to exploitation at the time of this writing. Atlassian has confirmed that it intends to release security fixes (patches) to its customer base that should be downloadable before the close of business (3pm EDT), today June 3, 2022. For more information on this please refer to the Atlassian Confluence Security Advisory 2022-06-02[v] which addresses their response and disclosure to CVE-2022-26134.

Affected Products	Confluence Confluence Server Confluence Data Center
Affected Versions	At the present time we have confirmed that all supported versions of Confluence Server and Data Center are affected. It is likely that all versions of Confluence Server and Data Center are affected, but we have yet to confirm the earliest affected version. This advisory will be updated as additional details become available

What You Need To Know and Do

Per the guidance provided by Atlassian[vi], here are the following recommendations that subscribing users may take advantage of at this time:

There are currently no fixed versions of Confluence Server and Data Center available. In the interim, customers should work with their security team to consider the best course of action. Options to consider include:

• Restricting access to Confluence Server and Data Center instances from the internet.

• Disabling Confluence Server and Data Center instances.

If you are unable to take the above actions implementing a WAF (Web Application Firewall) rule which blocks URLs containing ${ may reduce your risk.

How is NetWitness Responding to This 0-day vulnerability?

We currently have threat research and intelligence personnel engaged in work related to CVE-2022-26134. These researchers are vetting the information that we have in-hand from Volexity, Atlassian and our own research and moving forward with internal Proof of Concept (PoC) which will ultimately result in new threat research intelligence content (machine readable threat intelligence) and a more detailed blog related to that body of work and the practical application of our content within our product portfolio.

If you have any questions, please contact NetWitness Customer Support & Success or your account teams for more information. We also recommend that you subscribe to this channel to ensure that you are receiving the most up to date information possible.

[i] https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html

[ii] https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/

[iii] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26134

[iv] https://confluence.atlassian.com/doc/confluence-release-notes-327.html

[v] https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html

[vi] https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html

community_atlassian_confluence_rce_exploit.rar

[Will_G]

Hello All! 

We wanted to alert you to some rule logic that our team created to address this Atlassian Zero Day: 

[Community] Atlassian Confluence RCE exploit(CVE-2022-26134)

DESCRIPTION

This app rule detects Atlassian Confluence RCE exploit(CVE-2022-26134) attempt via HTTP/HTTPS traffic. Over the Memorial Day weekend in the United States, Volexity conducted an incident response investigation involving two Internet-facing web servers belonging to one of its customers that were running Atlassian Confluence Server software and Volexity was able to determine the server compromise stemmed from an attacker launching a 0-day exploit to achieve remote code execution.

VERSIONS SUPPORTED
* NetWitness Platform 11.x and higher

*GENERATED META KEYS
* boc = [Community] Atlassian Confluence RCE exploit(CVE-2022-26134)

Mediums

packet

Please see the attached .rar file for the rule. 

[RajasSave]

Greetings All,

As threat actors and advisories continues to exploit unpatched servers for Atlassian Confluence RCE exploit (CVE-2022-26134), researchers and content creators at Netwitness has released two new endpoint application rules in addition to previously released detections.

All three rules can be downloaded and deployed by searching under “Community” tab in Netwitness Live

[Community] Confluence Webshell Activity on Windows

This rule identifies shell processes such as 'cmd.exe' or Powershell being spawned by a tomcat process via the RCE vulnerability (CVE-2022-26134) affecting Atlassian Confluence 7.18 and lower products. The OGNL injection vulnerability allows an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance. Investigate the command being run and attempt to determine their purpose. Look for signs of further activity from a potential malicious actor, such as host or network discovery commands being executed, as these often precede attempts at lateral movement.

• boc = [Community] Confluence Webshell Activity on Windows
• Content Type - Application Rule
• Medium – Endpoint
• Dependencies - NetWitness Endpoint Server
• Platform Versions Supported - NetWitness Platform 11.x and higher

[Community] Confluence Web Shell Activity on Linux

This rule tries to identify web shell activity on a Atlassian Confluence Linux web server, which may suggest a vulnerability (CVE-2022-126134) and remote shell access.

• boc = [Community] Confluence Web Shell Activity on Linux
• Content Type - Application Rule
• Medium – Endpoint
• Dependencies - NetWitness Endpoint Server
• Platform Versions Supported - NetWitness Platform 11.x and higher

Other Detections -

[Community] Atlassian Confluence RCE exploit (CVE-2022-26134)

This app rule detects Atlassian Confluence RCE exploit (CVE-2022-26134) attempt via HTTP/HTTPS traffic. Over the Memorial Day weekend in the United States, Volexity conducted an incident response investigation involving two Internet-facing web servers belonging to one of its customers that were running Atlassian Confluence Server software and Volexity was able to determine the server compromise stemmed from an attacker launching a 0-day exploit to achieve remote code execution.

• boc = [Community] Atlassian Confluence RCE exploit (CVE-2022-26134)
• Content Type - Application Rule
• Medium – Packets
• Platform Versions Supported - NetWitness Platform 11.x and higher

Thanks to @jeethmathai and @SwethaDhalavari for valuable contribution in this effort. 

Regards,

@RajasSave 

Principal Threat Researcher
NetWitness, an RSA Business\