CVE-2022-26134
📋 TL;DR
CVE-2022-26134 is a critical OGNL injection vulnerability in Atlassian Confluence Server and Data Center that allows unauthenticated attackers to execute arbitrary code remotely. This affects Confluence instances running vulnerable versions, potentially compromising the entire server. Organizations using affected Confluence versions for collaboration are at immediate risk.
💻 Affected Systems
- Atlassian Confluence Server
- Atlassian Confluence Data Center
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the Confluence server, deploying ransomware, stealing sensitive data, and pivoting to internal networks.
Likely Case
Remote code execution leading to data theft, installation of backdoors, cryptocurrency miners, or disruption of Confluence services.
If Mitigated
Limited impact if network segmentation, WAF rules, and strict access controls prevent exploitation attempts.
🎯 Exploit Status
Multiple public proof-of-concept exploits available. Mass scanning and exploitation observed in the wild. Simple HTTP requests can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, 7.18.1 or later
Vendor Advisory: https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
Restart Required: Yes
Instructions:
1. Backup your Confluence instance. 2. Download the appropriate fixed version from Atlassian. 3. Stop Confluence service. 4. Apply the patch/upgrade. 5. Restart Confluence service. 6. Verify the fix.
🔧 Temporary Workarounds
Block vulnerable endpoints via web server
allBlock access to the vulnerable endpoint to prevent exploitation
# For Apache: RewriteRule ^/.*\.jsp.*$ - [F,L]
# For Nginx: location ~ \.jsp$ { return 403; }
WAF rule to block OGNL injection patterns
allConfigure WAF to block requests containing OGNL injection patterns
# Example ModSecurity rule: SecRule ARGS "\$\{.*\}" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Immediately isolate Confluence servers from internet and restrict network access
- Implement strict network segmentation and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Confluence version via Admin → General Configuration or run: grep -i 'confluence.version' confluence/WEB-INF/classes/confluence-init.propertiesCheck Version:
cat confluence/WEB-INF/classes/confluence-init.properties | grep confluence.versionVerify Fix Applied:
Verify version is 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, 7.18.1 or later📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to Confluence endpoints
- Requests containing OGNL expressions like ${...}
- Java process spawning unexpected child processes
Network Indicators:
- HTTP requests with OGNL payloads in parameters
- Unusual outbound connections from Confluence server
SIEM Query:
source="confluence.log" AND ("${*" OR "%24%7B*" OR "class.*forName" OR "Runtime.getRuntime")🔗 References
- http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html
- http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html
- http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
- https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
- https://jira.atlassian.com/browse/CONFSERVER-79016
- http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html
- http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html
- http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
- https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
- https://jira.atlassian.com/browse/CONFSERVER-79016
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134
