Loading vulnerability…
Unauthenticated OGNL Injection RCE in Atlassian Confluence
CVE-2022-26134 is an OGNL expression injection vulnerability in Atlassian Confluence Server and Data Center that allows unauthenticated remote attackers to execute arbitrary code through specially crafted HTTP request URIs. Attacker-controlled expressions can invoke Java functionality to execute operating-system commands and return command output in HTTP response headers. Observed payloads use Java Runtime or ProcessBuilder, sometimes through JavaScript engines such as Nashorn. Affected releases begin at version 1.3.0, with fixes released in versions 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1 for their respective release branches. Confluence Cloud is not affected. Disclosed on June 2, 2022, the vulnerability has been actively exploited and is included in CISA's Known Exploited Vulnerabilities catalog.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the Confluence application execution context, allowing unauthorized command execution, access to application data and other resources accessible to the service account, and modification or deletion of accessible information. Observed exploitation includes webshell installation, cryptominer deployment, and botnet malware delivery. Compromise can support persistence, sensitive-data exfiltration, service degradation, and subsequent lateral movement. Code execution does not inherently grant administrator or root privileges; its immediate scope depends on the permissions of the Confluence service account.
If you can’t patch tonight, do this now.
If immediate upgrading is not feasible, implement Atlassian's vendor-provided temporary workaround applicable to Confluence versions 7.0.0 through 7.18.0; the exact procedure is not specified here. Restrict external access to vulnerable instances and limit access to trusted networks until remediation is complete. Run Confluence with a minimally privileged service account to constrain post-exploitation impact. Monitor for unexpected shells, interpreters, discovery utilities, and other suspicious child processes launched by Confluence's Java or Tomcat processes. URI-only detection is insufficient because attackers encode exploit payloads.
Patch, then assume compromise.
Upgrade affected Confluence Server and Data Center installations to a currently supported release containing the fix. The original fixed releases were 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1. Atlassian released the security patches on June 3, 2022. Older installations should move to an appropriate fixed release rather than remain on an unpatched branch.
33 exploits validated by Mallory's analysis. Hidden: 5 rejected by Mallory's analysis as not a working exploit; 2 not yet analyzed, such as Exploit-DB entries. Showing the 25 most capable, earliest first.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
64 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.