Active Exploitation of Confluence CVE-2022-26134 by Rapid7 | PT SWARM

Active Exploitation of Confluence CVE-2022-26134

by Rapid7

On June 2, 2022, Atlassian published a security advisory for CVE-2022-26134, a critical unauthenticated remote code execution vulnerability in Confluence Server and Confluence Data Center. The vulnerability was unpatched when it was published on June 2. As of June 3, both patches and a temporary workaround are available.
CVE-2022-26314 is an unauthenticated and remote OGNL injection vulnerability resulting in code execution in the context of the Confluence server (typically the confluence user on Linux installations). Given the nature of the vulnerability, internet-facing Confluence servers are at very high risk.

Contents:
• Technical analysis
•• The vulnerability
•• Root cause
•• The patch
•• Payloads
• Mitigation guidance

https://www.rapid7.com/ja/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/