Apply patches immediately!
A critical zero-day security vulnerability was discovered on June 2 in Atlassian Confluence. It affects all supported versions of Confluence Server and Data Center, as well as all versions later than 1.3.0. Known as CVE-2022-26134, this vulnerability allows an unauthenticated attacker to trigger remote arbitrary code execution.
What is this about?
Security researchers have found that malicious actors are exploiting this vulnerability to install the Chopper webshell and other malware. This has prompted the Cybersecurity and Infrastructure Security Agency (CISA) in the U.S. to urge federal agencies to block all Internet access to Confluence servers on their networks. For its part, CERT-FR has called for disconnecting the service from the Internet until patches are applied and a check to detect a potential compromise has been performed.
The researchers also published a proof-of-concept (PoC) for the critical vulnerability CVE-2022-26134 on June 3. The proof-of-concept code demonstrates the pprocess of creating new administrator accounts, injecting DNS queries, collecting sensitive data, and generating reverse shells.
Bug Fixes
Atlassian has released security patches to fix the vulnerability in the following versions:
- 7.4.17
- 7.13.7
- 7.14.3
- 7.15.2
- 7.16.4
- 7.17.4
- 7.18.1.
The company has advised all client companies to upgrade to the latest version of Confluence. In the meantime, IT administrators who cannot apply the patches immediately should update certain JAR files on their Confluence servers.
> For more information, visit the dedicated page at Atlassian Confluence.
Additional recommendations:
> Don’t leave these types of services exposed and unprotected. ITrust offers tools to detect cyber threats, ransomware, viruses, and abnormal behavior within your IT infrastructure, such as our Reveelium UEBA SIEM.
> Regularly scan your network to detect security vulnerabilities and identify patches that need to be applied. Our vulnerability scanner IKare, available as a free trial, helps detect new security vulnerabilities.
If you need help fixing these issues, give us a call. (05.67.34.67.80)
*Sources: CERT-FR , Confluence Security Advisory
