Is CVE-2022-26134 patched on Confluence?

Confluence Server and Data Center are vulnerable to an OGNL injection vulnerability that allows an unauthenticated attacker to execute arbitrary code. This TTP attempts to execute code on the Confluence server. The affected versions are from 1.3.0 before 7.4.17 and most LTS versions before 7.18.1.

2022-07-19

Professional

Authors:vvx7

TTP Tuesday: Confluence Server CVE-2022-26134

OGNL injection in Confluence Server & Data Center allows unauthenticated remote code execution

CVE-2022-26134: OGNL injection in Confluence Server

This vulnerability allows unauthenticated arbitrary code execution on Confluence Server & Data Center. It does this by taking advantage of how OGNL, an Expression Language for Java objects, evaluates user-supplied data.

OGNL injection is an example of server-side template injection which is when an attacker exploits a template syntax bug to inject code into the template engine. Template engines are used to generate web pages and other dynamic content via a special template syntax that substitutes values into a parameterized syntax template. A familiar example may be the Jinja templating library in Python or Mustache for JavaScript.

In Confluence Server and Data Center, from 1.3.0 before 7.4.17 and affecting other LTS releases up to 7.18.1, an OGNL vulnerability exists that allows an unauthenticated user to remotely execute code on the server. The exploit requires sending an HTTP GET request to the Confluence Server using a specially crafted URL containing the template engine exploit. When Confluence handles this GET request the template engine executes the template code and no further user interaction is required.

Testing

Execute Operator’s CVE-2022-26134 TTP on each Confluence Server instance in your environment to test if you are vulnerable.

The TTP is configured to send a GET request to localhost using the default Confluence Server port 8090. Depending on your Confluence configuration, and whether this TTP is being run on the server or remotely, it may be necessary to adjust the URL in the TTP file. When the exploit is successful the GET response will contain a special X-Prelude-Response: CVE-2022-26134 header.

Vulnerability scanners typically test this CVE by relying on remote exploitation of the Confluence Server via the specially crafted request. For example, if a server is running a Confluence instance, it will craft a specific HTTP GET request with the malicious code to see if it executes. This will expose whether the Confluence instance can be exploited.

Remediation

Upgrade Confluence Server & Data Center to the latest version. Atlassian has published a security advisory with instructions for patching and a temporary mitigation if patching is not an option.

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org/download/current
See the latest kill chain and TTP Releases: https://chains.prelude.org/
See our open-source repositories: https://github.com/preludeorg

Source: https://feed.prelude.org

Execute this chain

Download Operator (1.7.1)