A major Atlassian Confluence vulnerability recently discovered in almost all versions of the collaboration tool published over the last decade, is now being actively exploited by threat actors, the company confirmed.
The vulnerability allows threat actors to mount unauthenticated remote code execution attacks against target endpoints. A day after its discovery, the company released patches for versions 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1.
Given that the flaw is being actively leveraged, the company has urged its users and customers to update the tool to the newest version, immediately. It is being tracked as CVE-2022-26134, but does not yet have a severity score. Atlassian rated it as “critical”.
Limiting internet access
It was first discovered by security firm Volexity, which said attackers could insert a Java Server Page webshell into a publicly accessible web directory on a Confluence server.
Confluence’s web application process was also found to have been launching bash shells, something that “stood out”, Volexity said, as it spawned a bash process which triggered a Python process, spawning a bash shell.
Confluence users that are unable to apply the patch for whatever reason, have a couple of additional mitigation options at their disposal, which revolve around limiting internet access for the tool. While the patch was in development, the company advised users to either Restrict Confluence Server and Data Center instances’ access to the internet, or disable Confluence Server and Data Center instances entirely.
Atlassian also said companies could implement a Web Application Firewall (WAF) rule to block all URLs containing ${, as that "may reduce your risk”.
While the company did stress “current active exploitation” in its advisory, it did not detail who is using it, or against whom.
Via: The Register