Atlassian Releases Patch for Confluence Zero-Day Flaw Exploited in the Wild

Atlassian on Friday rolled out fixes to deal with a critical security flaw influencing its Confluence Server and Knowledge Centre products and solutions that have arrive beneath energetic exploitation by menace actors to obtain distant code execution.

Tracked as CVE-2022-26134, the issue is very similar to CVE-2021-26084 — an additional security flaw the Australian software package corporation patched in August 2021.

The two relate to a situation of Object-Graph Navigation Language (OGNL) injection that could be exploited to achieve arbitrary code execution on a Confluence Server or Data Middle instance.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The recently uncovered shortcoming impacts all supported variations of Confluence Server and Info Heart, with just about every variation immediately after 1.3. also affected. It’s been resolved in the pursuing versions –

• 7.4.17
• 7.13.7
• 7.14.3
• 7.15.2
• 7.16.4
• 7.17.4
• 7.18.1

In accordance to stats from internet asset discovery system Censys, there are about 9,325 solutions across 8,347 unique hosts jogging a susceptible edition of Atlassian Confluence, with most situations situated in the U.S., China, Germany, Russia, and France.

Evidence of active exploitation of the flaw, likely by attackers of Chinese origin, arrived to light soon after cybersecurity firm Volexity uncovered the flaw over the Memorial Day weekend in the U.S. all through an incident reaction investigation.

“The qualified industries/verticals are quite widespread,” Steven Adair, founder and president of Volexity, claimed in a sequence of tweets. “This is a absolutely free-for-all where the exploitation appears to be coordinated.”

“It is crystal clear that numerous danger teams and specific actors have the exploit and have been using it in distinct methods. Some are rather sloppy and other individuals are a little bit extra stealth.”

The U.S. Cybersecurity and Infrastructure Security Company (CISA), besides including the zero-working day bug to its Identified Exploited Vulnerabilities Catalog, has also urged federal companies to straight away block all internet targeted traffic to and from the afflicted products and both use the patches or clear away the instances by June 6, 2022, 5 p.m. ET.

Identified this article interesting? Follow THN on Fb, Twitter  and LinkedIn to study much more unique information we post.