CVE-2022-26134
CVE-2022-26134
En resumen
Confluence Server y Data Center tienen una falla crítica que permite a cualquier persona en internet ejecutar código malicioso en el servidor afectado sin necesidad de contraseña. Esto ocurre porque la aplicación procesa incorrectamente la entrada del usuario a través de OGNL (Object-Graph Navigation Language), un sistema de plantillas.
Detalle técnico
Un atacante remoto no autenticado puede explotar una vulnerabilidad de inyección OGNL (CWE-917) en Confluence Server y Data Center para lograr ejecución arbitraria de código. La vulnerabilidad resulta de validación insuficiente en el manejo de expresiones OGNL, permitiendo la inyección de expresiones maliciosas que se evalúan en el servidor. Afecta versiones 1.3.0–7.4.16, 7.13.0–7.13.6, 7.14.0–7.14.2, 7.15.0–7.15.1, 7.16.0–7.16.3, 7.17.0–7.17.3 y 7.18.0.
Resumen generado y traducido por IA a partir de la descripción oficial.
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
PoCs públicas encontradas — 77
githubgithub.com/W01fh4cker/Serein★ 1250githubgithub.com/BeichenDream/CVE-2022-26134-Godzilla-MEMSHELL★ 341githubgithub.com/jbaines-r7/through_the_wire★ 174githubgithub.com/hev0x/CVE-2022-26134★ 44githubgithub.com/crowsec-edtech/CVE-2022-26134★ 30githubgithub.com/nxtexploit/CVE-2022-26134★ 29githubgithub.com/SNCKER/CVE-2022-26134★ 27githubgithub.com/SIFalcon/confluencePot★ 20githubgithub.com/AmoloHT/CVE-2022-26134★ 14githubgithub.com/whokilleddb/CVE-2022-26134-Confluence-RCE★ 13githubgithub.com/iveresk/cve-2022-26134★ 12githubgithub.com/redhuntlabs/ConfluentPwn★ 12githubgithub.com/MaskCyberSecurityTeam/CVE-2022-26134_Behinder_MemShell★ 9githubgithub.com/offlinehoster/CVE-2022-26134★ 8githubgithub.com/abhishekmorla/CVE-2022-26134★ 8githubgithub.com/keven1z/CVE-2022-26134★ 7githubgithub.com/BBD-YZZ/Confluence-RCE★ 5githubgithub.com/archanchoudhury/Confluence-CVE-2022-26134★ 4githubgithub.com/kh4sh3i/CVE-2022-26134★ 4githubgithub.com/alcaparra/CVE-2022-26134★ 4githubgithub.com/Chocapikk/CVE-2022-26134★ 4githubgithub.com/Y000o/Confluence-CVE-2022-26134★ 4githubgithub.com/li8u99/CVE-2022-26134★ 4githubgithub.com/Debajyoti0-0/CVE-2022-26134★ 3githubgithub.com/cai-niao98/CVE-2022-26134★ 3githubgithub.com/Vulnmachines/Confluence-CVE-2022-26134★ 3githubgithub.com/skhalsa-sigsci/CVE-2022-26134-LAB★ 3githubgithub.com/kyxiaxiang/CVE-2022-26134★ 3githubgithub.com/cbk914/CVE-2022-26134_check★ 3githubgithub.com/KeepWannabe/BotCon★ 3githubgithub.com/twoning/CVE-2022-26134-PoC★ 2githubgithub.com/b4dboy17/CVE-2022-26134★ 2githubgithub.com/f4yd4-s3c/cve-2022-26134★ 2githubgithub.com/Brucetg/CVE-2022-26134★ 2githubgithub.com/ColdFusionX/CVE-2022-26134★ 2githubgithub.com/p4b3l1t0/confusploit★ 2githubgithub.com/kailing0220/CVE-2022-26134★ 1githubgithub.com/1337in/CVE-2022-26134web★ 1githubgithub.com/acfirthh/CVE-2022-26134★ 1githubgithub.com/r1skkam/TryHackMe-Atlassian-CVE-2022-26134★ 1githubgithub.com/reubensammut/cve-2022-26134★ 1githubgithub.com/0xAgun/CVE-2022-26134★ 1githubgithub.com/coskper-papa/CVE-2022-26134★ 1githubgithub.com/ma1am/CVE-2022-26134-Exploit-Detection★ 1githubgithub.com/CJ-0107/cve-2022-26134★ 1githubgithub.com/axingde/CVE-2022-26134★ 1githubgithub.com/shamo0/CVE-2022-26134★ 1githubgithub.com/kelemaoya/CVE-2022-26134★ 1githubgithub.com/404fu/CVE-2022-26134-POC★ 1githubgithub.com/Habib0x0/CVE-2022-26134★ 1githubgithub.com/wjlin0/CVE-2022-26134★ 0githubgithub.com/vesperp/CVE-2022-26134-Confluence★ 0githubgithub.com/secjia/CVE-2022-26134★ 0githubgithub.com/sunny-kathuria/exploit_CVE-2022-26134★ 0githubgithub.com/Luchoane/CVE-2022-26134_conFLU★ 0githubgithub.com/shiftsansan/CVE-2022-26134-Console★ 0githubgithub.com/yigexioabai/CVE-2022-26134-cve1★ 0githubgithub.com/xanszZZ/ATLASSIAN-Confluence_rce★ 0githubgithub.com/latings/CVE-2022-26134★ 0githubgithub.com/yyqxi/CVE-2022-26134★ 0githubgithub.com/tpdlshdmlrkfmcla/cve-2022-26134★ 0githubgithub.com/thetowsif/CVE-2022-26134★ 0githubgithub.com/MAHABUB122003/Atlassian-CVE-2022-26134★ 0githubgithub.com/crypt0lith/confluence-ognl-rce★ 0githubgithub.com/roodhelios/CVE-2022-26134-OGNL-Injection★ 0githubgithub.com/Muhammad-Ali007/Atlassian_CVE-2022-26134★ 0githubgithub.com/yTxZx/CVE-2022-26134★ 0githubgithub.com/DARKSTUFF-LAB/-CVE-2022-26134★ 0githubgithub.com/xsxtw/CVE-2022-26134★ 0githubgithub.com/cc3305/CVE-2022-26134★ 0githubgithub.com/Gilospy/CVE-2022-26134★ 0githubgithub.com/Khalidhaimur/CVE-2022-26134★ 0cve_referencepacketstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.htmlno verificadocve_referencepacketstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.htmlno verificadocve_referencepacketstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.htmlno verificadoexploitdbwww.exploit-db.com/exploits/50952no verificadocve_referencepacketstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.htmlno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →Referencias
http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.htmlhttp://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.htmlhttp://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.htmlhttps://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.htmlhttps://jira.atlassian.com/browse/CONFSERVER-79016https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134