CVE-2022-26134criticalbajo ataqueransomwareCWE-917

CVE-2022-26134: fallo crítico en Atlassian Confluence Server

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Confluence Server+ Monitorear Confluence Data Center

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

100Vexday Risk Score

Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.

ssvc Actcvss 9.8epss 100%
de la publicación al armael mismo día
Publicada en NVD3 jun
1ª PoC31 may
metasploit2 jun
CISA KEV2 jun
Acción exigida por CISAplazo federal: 2022-06-06

Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.

En resumen

Confluence Server y Data Center tienen una falla crítica que permite a cualquier persona en internet ejecutar código malicioso en el servidor afectado sin necesidad de contraseña. Esto ocurre porque la aplicación procesa incorrectamente la entrada del usuario a través de OGNL (Object-Graph Navigation Language), un sistema de plantillas.

Detalle técnico

Un atacante remoto no autenticado puede explotar una vulnerabilidad de inyección OGNL (CWE-917) en Confluence Server y Data Center para lograr ejecución arbitraria de código. La vulnerabilidad resulta de validación insuficiente en el manejo de expresiones OGNL, permitiendo la inyección de expresiones maliciosas que se evalúan en el servidor. Afecta versiones 1.3.0–7.4.16, 7.13.0–7.13.6, 7.14.0–7.14.2, 7.15.0–7.15.1, 7.16.0–7.16.3, 7.17.0–7.17.3 y 7.18.0.

Resumen generado y traducido por IA a partir de la descripción oficial.

El análisis completo de esta CVE está disponible en portugués →

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Atlassian · Confluence Data CenterAtlassian · Confluence Server
PoCs públicas encontradas — 146
exploitdbwww.exploit-db.com/exploits/50952no verificadogithubgithub.com/W01fh4cker/Serein★ 1244githubgithub.com/BeichenDream/CVE-2022-26134-Godzilla-MEMSHELL★ 339githubgithub.com/jbaines-r7/through_the_wire★ 174githubgithub.com/hev0x/CVE-2022-26134★ 44githubgithub.com/crowsec-edtech/CVE-2022-26134★ 31githubgithub.com/nxtexploit/CVE-2022-26134★ 29githubgithub.com/SNCKER/CVE-2022-26134★ 26githubgithub.com/SIFalcon/confluencePot★ 20githubgithub.com/AmoloHT/CVE-2022-26134★ 14githubgithub.com/redhuntlabs/ConfluentPwn★ 13githubgithub.com/whokilleddb/CVE-2022-26134-Confluence-RCE★ 13githubgithub.com/iveresk/cve-2022-26134★ 12githubgithub.com/offlinehoster/CVE-2022-26134★ 8githubgithub.com/abhishekmorla/CVE-2022-26134★ 8githubgithub.com/MaskCyberSecurityTeam/CVE-2022-26134_Behinder_MemShell★ 8githubgithub.com/keven1z/CVE-2022-26134★ 7githubgithub.com/BBD-YZZ/Confluence-RCE★ 5githubgithub.com/Chocapikk/CVE-2022-26134★ 4githubgithub.com/Y000o/Confluence-CVE-2022-26134★ 4githubgithub.com/li8u99/CVE-2022-26134★ 4githubgithub.com/Debajyoti0-0/CVE-2022-26134★ 4githubgithub.com/archanchoudhury/Confluence-CVE-2022-26134★ 4githubgithub.com/kh4sh3i/CVE-2022-26134★ 4githubgithub.com/alcaparra/CVE-2022-26134★ 4githubgithub.com/cai-niao98/CVE-2022-26134★ 3githubgithub.com/Vulnmachines/Confluence-CVE-2022-26134★ 3githubgithub.com/skhalsa-sigsci/CVE-2022-26134-LAB★ 3githubgithub.com/KeepWannabe/BotCon★ 3githubgithub.com/kyxiaxiang/CVE-2022-26134★ 3githubgithub.com/cbk914/CVE-2022-26134_check★ 3githubgithub.com/f4yd4-s3c/cve-2022-26134★ 2githubgithub.com/twoning/CVE-2022-26134-PoC★ 2githubgithub.com/b4dboy17/CVE-2022-26134★ 2githubgithub.com/p4b3l1t0/confusploit★ 2githubgithub.com/Brucetg/CVE-2022-26134★ 2githubgithub.com/axingde/CVE-2022-26134★ 1githubgithub.com/CJ-0107/cve-2022-26134★ 1githubgithub.com/1337in/CVE-2022-26134web★ 1githubgithub.com/coskper-papa/CVE-2022-26134★ 1githubgithub.com/reubensammut/cve-2022-26134★ 1githubgithub.com/404fu/CVE-2022-26134-POC★ 1githubgithub.com/r1skkam/TryHackMe-Atlassian-CVE-2022-26134★ 1githubgithub.com/kelemaoya/CVE-2022-26134★ 1githubgithub.com/shamo0/CVE-2022-26134★ 1githubgithub.com/0xAgun/CVE-2022-26134★ 1githubgithub.com/acfirthh/CVE-2022-26134★ 1githubgithub.com/ColdFusionX/CVE-2022-26134★ 1githubgithub.com/kailing0220/CVE-2022-26134★ 1githubgithub.com/ma1am/CVE-2022-26134-Exploit-Detection★ 1githubgithub.com/Habib0x0/CVE-2022-26134★ 1githubgithub.com/vesperp/CVE-2022-26134-Confluence★ 0githubgithub.com/Muhammad-Ali007/Atlassian_CVE-2022-26134★ 0githubgithub.com/Khalidhaimur/CVE-2022-26134★ 0githubgithub.com/MAHABUB122003/Atlassian-CVE-2022-26134★ 0githubgithub.com/roodhelios/CVE-2022-26134-OGNL-Injection★ 0githubgithub.com/sunny-kathuria/exploit_CVE-2022-26134★ 0githubgithub.com/Luchoane/CVE-2022-26134_conFLU★ 0githubgithub.com/yyqxi/CVE-2022-26134★ 0githubgithub.com/cc3305/CVE-2022-26134★ 0githubgithub.com/Gilospy/CVE-2022-26134★ 0githubgithub.com/secjia/CVE-2022-26134★ 0githubgithub.com/yTxZx/CVE-2022-26134★ 0githubgithub.com/xsxtw/CVE-2022-26134★ 0githubgithub.com/crypt0lith/confluence-ognl-rce★ 0githubgithub.com/RootEvil333/CVE-2022-26134★ 0githubgithub.com/latings/CVE-2022-26134★ 0githubgithub.com/tpdlshdmlrkfmcla/cve-2022-26134★ 0githubgithub.com/wjlin0/CVE-2022-26134★ 0githubgithub.com/shiftsansan/CVE-2022-26134-Console★ 0githubgithub.com/thetowsif/CVE-2022-26134★ 0githubgithub.com/yigexioabai/CVE-2022-26134-cve1★ 0githubgithub.com/xanszZZ/ATLASSIAN-Confluence_rce★ 0githubgithub.com/DARKSTUFF-LAB/-CVE-2022-26134★ 0vulncheckvulncheck.com/xdb/d0540ce1cb8dno verificadovulncheckvulncheck.com/xdb/afb357664032no verificadovulncheckvulncheck.com/xdb/36e25b480581no verificadovulncheckvulncheck.com/xdb/68a67174cffbno verificadovulncheckvulncheck.com/xdb/b0ddf8e8e190no verificadovulncheckvulncheck.com/xdb/e68dc3f67ff5no verificadovulncheckvulncheck.com/xdb/0e38e7f0c998no verificadovulncheckvulncheck.com/xdb/ccf22111c515no verificadovulncheckvulncheck.com/xdb/4dd293ad4c62no verificadovulncheckvulncheck.com/xdb/546df2d43760no verificadovulncheckvulncheck.com/xdb/66716e60c64ano verificadovulncheckvulncheck.com/xdb/33ae84bef451no verificadovulncheckvulncheck.com/xdb/4a62fb975d25no verificadovulncheckvulncheck.com/xdb/6e3b669985c0no verificadovulncheckvulncheck.com/xdb/610e8ac40120no verificadovulncheckvulncheck.com/xdb/b8975356b7ecno verificadovulncheckvulncheck.com/xdb/6f9382355146no verificadovulncheckvulncheck.com/xdb/5b4caf96d2c6no verificadovulncheckvulncheck.com/xdb/86443907f2d8no verificadovulncheckvulncheck.com/xdb/9fecf5c3535ano verificadovulncheckvulncheck.com/xdb/d8d2a4e09b27no verificadovulncheckvulncheck.com/xdb/aa3c74a7faf0no verificadovulncheckvulncheck.com/xdb/61805bb30396no verificadovulncheckvulncheck.com/xdb/090edbfc3023no verificadovulncheckvulncheck.com/xdb/842a7b278086no verificadovulncheckvulncheck.com/xdb/addd382b1e54no verificadovulncheckvulncheck.com/xdb/eb21e9bfe5ebno verificadovulncheckvulncheck.com/xdb/3e4ac0104159no verificadovulncheckvulncheck.com/xdb/6faa1c9d88f6no verificadovulncheckvulncheck.com/xdb/6e612cea3ddano verificadovulncheckvulncheck.com/xdb/d673882b1749no verificadovulncheckvulncheck.com/xdb/39e06de0be1fno verificadovulncheckvulncheck.com/xdb/c75d37232bc3no verificadovulncheckvulncheck.com/xdb/dc2f3c02f8d4no verificadovulncheckvulncheck.com/xdb/14047453ba17no verificadovulncheckvulncheck.com/xdb/628331d44c34no verificadovulncheckvulncheck.com/xdb/84304f834234no verificadovulncheckvulncheck.com/xdb/648550535509no verificadovulncheckvulncheck.com/xdb/bf4a212e429bno verificadovulncheckvulncheck.com/xdb/556ef02d9595no verificadovulncheckvulncheck.com/xdb/fe6b0b57fa24no verificadovulncheckvulncheck.com/xdb/f1b043c20876no verificadovulncheckvulncheck.com/xdb/2d3e861a0832no verificadovulncheckvulncheck.com/xdb/3ad15a0e2ac3no verificadocve_referencepacketstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.htmlno verificadovulncheckvulncheck.com/xdb/8974c552a2e5no verificadovulncheckvulncheck.com/xdb/a43aebbe5a90no verificadovulncheckvulncheck.com/xdb/3d93a29f925bno verificadovulncheckvulncheck.com/xdb/6bc3d8b79311no verificadovulncheckvulncheck.com/xdb/2c33af279252no verificadovulncheckvulncheck.com/xdb/ca9e684d7a83no verificadocve_referencepacketstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.htmlno verificadovulncheckvulncheck.com/xdb/eda8223e977dno verificadovulncheckvulncheck.com/xdb/500036fec42eno verificadovulncheckvulncheck.com/xdb/780c87a82988no verificadovulncheckvulncheck.com/xdb/ab530000a4e4no verificadovulncheckvulncheck.com/xdb/414ebc87cd3bno verificadovulncheckvulncheck.com/xdb/e4386919f2b9no verificadovulncheckvulncheck.com/xdb/3786abbc3b80no verificadovulncheckvulncheck.com/xdb/7335c8b64e5ano verificadovulncheckvulncheck.com/xdb/4162abbf3203no verificadovulncheckvulncheck.com/xdb/c15ae388f037no verificadovulncheckvulncheck.com/xdb/827f3f601d2ano verificadovulncheckvulncheck.com/xdb/c04e3752492bno verificadovulncheckvulncheck.com/xdb/4131279556d5no verificadovulncheckvulncheck.com/xdb/13d8edcd31c1no verificadovulncheckvulncheck.com/xdb/a518d737580dno verificadocve_referencepacketstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.htmlno verificadovulncheckvulncheck.com/xdb/bef9a90a6d01no verificadovulncheckvulncheck.com/xdb/88cd3575ffb8no verificadocve_referencepacketstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.htmlno verificadovulncheckvulncheck.com/xdb/4221888e84f0no verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Atlassian Confluence Server

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-22518CRITICALCVE-2023-22518EPSS 100.0%KEVCVE-2021-26084CRITICALCVE-2021-26084EPSS 100.0%KEVCVE-2023-22527CRITICALCVE-2023-22527EPSS 100.0%KEVCVE-2021-26085MEDIUMCVE-2021-26085EPSS 99.9%KEVCVE-2019-3396CRITICALCVE-2019-3396EPSS 99.9%KEVCVE-2026-21589CRITICALCVE-2026-21589EPSS 99.7%KEV