Critical Remote Code Execution Vulnerability Affects Atlassian Confluence Servers

Atlassian has published an advisory regarding an actively exploited critical remote code execution (RCE) vulnerability affecting Confluence and Data center servers. The flaw, tracked as CVE-2022-26134, is described as an Object-Graph Navigation Language (OGNL) injection vulnerability, and if exploited would allow unauthenticated remote attackers to create privileged user accounts to execute commands with administrator rights, force DNS requests, and take full control of the target server. Atlassian disclosed the vulnerability after the Memorial Day 2022 weekend, following an incident response investigation conducted by Volexity which found multiple threat actors (hundreds of unique IP addresses) exploiting this flaw. Shortly after releasing the patch, researchers from Lacework Labs also found the presence of three (3) different botnets exploiting this vulnerability, tracked as Kinsing, Hezb, and “Dark.IoT”. These botnets are known for targeting Linux-based servers to deploy backdoors, Cobalt Strike beacons and XMRig miners. Confluence servers are a very popular target for threat actors to gain initial access to corporate networks, where they conduct follow-on malicious activity like pilfering sensitive data, deploying ransomware variants, cryptojacking miners, and conducting corporate cyber-espionage. This critical vulnerability has been officially patched by Atlassian, and CTIX analysts urge administrators maintaining this infrastructure to update their systems to the latest Confluence version available to them. If enterprise organizations run their Confluence Server and Data Server infrastructure in compartmentalized clusters, then their administrators won’t be able to upgrade all at once and will instead have to implement the patch in a systematic “rolling update.” In these cases, Atlassian has offered a manual mitigation technique so that administrators can prevent exploitation on the rest of their server clusters while they take a cluster offline to install the patch.