Hackers Exploiting Unpatched Critical Atlassian Confluence Zero-Day Vulnerability

Atlassian has warned of a critical unpatched distant code execution vulnerability impacting Confluence Server and Data Centre products that it said is becoming actively exploited in the wild.

The Australian program company credited cybersecurity firm Volexity for pinpointing the flaw, which is getting tracked as CVE-2022-26134.

“Atlassian has been built informed of present lively exploitation of a critical severity unauthenticated remote code execution vulnerability in Confluence Info Middle and Server,” it explained in an advisory.

“There are at the moment no mounted versions of Confluence Server and Details Centre obtainable. Atlassian is functioning with the greatest precedence to issue a resolve.” Specifics of the security flaw have been withheld until eventually a software package patch is offered.

Confluence Server variation 7.18. is regarded to have been exploited in the wild, while Confluence Server and Knowledge Heart versions 7.4. and later on are probably susceptible.

In the absence of a repair, Atlassian is urging shoppers to prohibit Confluence Server and Data Middle circumstances from the internet or take into consideration disabling Confluence Server and Facts Centre situations altogether.

Volexity, in an impartial disclosure, explained it detected the action more than the Memorial Working day weekend in the U.S. as part of an incident reaction investigation.

The attack chain associated leveraging the Atlassian zero-working day exploit — a command injection vulnerability — to reach unauthenticated distant code execution on the server, enabling the threat actor to use the foothold to drop the Behinder web shell.

“Behinder supplies really powerful abilities to attackers, which includes memory-only webshells and constructed-in assist for conversation with Meterpreter and Cobalt Strike,” the researchers claimed. “At the identical time, it does not let persistence, which suggests a reboot or assistance restart will wipe it out.”

Subsequently, the web shell is claimed to have been employed as a conduit to deploy two further web shells to disk, such as China Chopper and a custom file add shell to exfiltrate arbitrary data files to a distant server.

The progress arrives significantly less than a calendar year soon after a different critical remote code execution flaw in Atlassian Confluence (CVE-2021-26084, CVSS score: 9.8) was actively weaponized in the wild to set up cryptocurrency miners on compromised servers.

“By exploiting this type of vulnerability, attackers can attain immediate entry to very delicate programs and networks,” Volexity said. “Further more, these units can frequently be tough to investigate, as they absence the suitable checking or logging abilities.”

Discovered this post fascinating? Abide by THN on Facebook, Twitter  and LinkedIn to read through much more exceptional information we publish.

Some areas of this report are sourced from:
thehackernews.com