A major Atlassian Confluence vulnerability recently discovered in almost all versions of the collaboration tool (opens in new tab) published over the last decade, is now being actively exploited by threat actors, the company confirmed.
The vulnerability allows threat actors to mount unauthenticated remote code execution attacks against target endpoints (opens in new tab). A day after its discovery, the company released patches for versions 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1.
Given that the flaw is being actively leveraged, the company has urged its users and customers to update the tool (opens in new tab) to the newest version, immediately. It is being tracked as CVE-2022-26134, but does not yet have a severity score. Atlassian rated it as “critical”.
(opens in new tab)Limiting internet access
It was first discovered by security firm Volexity, which said attackers could insert a Java Server Page webshell into a publicly accessible web directory on a Confluence server.
Confluence’s web application process was also found to have been launching bash shells, something that “stood out”, Volexity said, as it spawned a bash process which triggered a Python process, spawning a bash shell.
> Atlassian orders customers to cut internet access to Confluence after critical bug discovered (opens in new tab)
> Atlassian Confluence is under heavy attack (opens in new tab)
> Atlassian Confluence hacked to mine Monero (opens in new tab)
Confluence users that are unable to apply the patch for whatever reason, have a couple of additional mitigation options at their disposal, which revolve around limiting internet access for the tool. While the patch was in development, the company advised users to either Restrict Confluence Server and Data Center instances’ access to the internet, or disable Confluence Server and Data Center instances entirely.
Atlassian also said companies could implement a Web Application Firewall (WAF) rule to block all URLs containing ${, as that "may reduce your risk”.
While the company did stress “current active exploitation” in its advisory, it did not detail who is using it, or against whom.
- Protect your devices from software flaws with the best antivirus solutions around (opens in new tab)
Via: The Register (opens in new tab)
