CVE-2022-26134
CVE-2022-26134
Em resumo
O Confluence Server e Data Center têm uma falha crítica que permite que qualquer pessoa na internet execute código malicioso no servidor afetado sem precisar de senha. Isso ocorre porque a aplicação processa incorretamente entrada do usuário através de OGNL (Object-Graph Navigation Language), um sistema de templating.
Detalhe técnico
Um atacante remoto não autenticado pode explorar uma vulnerabilidade de injeção OGNL (CWE-917) no Confluence Server e Data Center para alcançar execução arbitrária de código. A vulnerabilidade resulta de validação insuficiente de entrada no processamento de expressões OGNL, permitindo injeção de expressões maliciosas que são avaliadas no servidor. Afeta versões 1.3.0–7.4.16, 7.13.0–7.13.6, 7.14.0–7.14.2, 7.15.0–7.15.1, 7.16.0–7.16.3, 7.17.0–7.17.3 e 7.18.0.
Resumo gerado e traduzido por IA a partir da descrição oficial.
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
PoCs públicas encontradas — 77
githubgithub.com/W01fh4cker/Serein★ 1250githubgithub.com/BeichenDream/CVE-2022-26134-Godzilla-MEMSHELL★ 341githubgithub.com/jbaines-r7/through_the_wire★ 174githubgithub.com/hev0x/CVE-2022-26134★ 44githubgithub.com/crowsec-edtech/CVE-2022-26134★ 30githubgithub.com/nxtexploit/CVE-2022-26134★ 29githubgithub.com/SNCKER/CVE-2022-26134★ 27githubgithub.com/SIFalcon/confluencePot★ 20githubgithub.com/AmoloHT/CVE-2022-26134★ 14githubgithub.com/whokilleddb/CVE-2022-26134-Confluence-RCE★ 13githubgithub.com/iveresk/cve-2022-26134★ 12githubgithub.com/redhuntlabs/ConfluentPwn★ 12githubgithub.com/MaskCyberSecurityTeam/CVE-2022-26134_Behinder_MemShell★ 9githubgithub.com/offlinehoster/CVE-2022-26134★ 8githubgithub.com/abhishekmorla/CVE-2022-26134★ 8githubgithub.com/keven1z/CVE-2022-26134★ 7githubgithub.com/BBD-YZZ/Confluence-RCE★ 5githubgithub.com/archanchoudhury/Confluence-CVE-2022-26134★ 4githubgithub.com/kh4sh3i/CVE-2022-26134★ 4githubgithub.com/alcaparra/CVE-2022-26134★ 4githubgithub.com/Chocapikk/CVE-2022-26134★ 4githubgithub.com/Y000o/Confluence-CVE-2022-26134★ 4githubgithub.com/li8u99/CVE-2022-26134★ 4githubgithub.com/Debajyoti0-0/CVE-2022-26134★ 3githubgithub.com/cai-niao98/CVE-2022-26134★ 3githubgithub.com/Vulnmachines/Confluence-CVE-2022-26134★ 3githubgithub.com/skhalsa-sigsci/CVE-2022-26134-LAB★ 3githubgithub.com/kyxiaxiang/CVE-2022-26134★ 3githubgithub.com/cbk914/CVE-2022-26134_check★ 3githubgithub.com/KeepWannabe/BotCon★ 3githubgithub.com/twoning/CVE-2022-26134-PoC★ 2githubgithub.com/b4dboy17/CVE-2022-26134★ 2githubgithub.com/f4yd4-s3c/cve-2022-26134★ 2githubgithub.com/Brucetg/CVE-2022-26134★ 2githubgithub.com/ColdFusionX/CVE-2022-26134★ 2githubgithub.com/p4b3l1t0/confusploit★ 2githubgithub.com/kailing0220/CVE-2022-26134★ 1githubgithub.com/1337in/CVE-2022-26134web★ 1githubgithub.com/acfirthh/CVE-2022-26134★ 1githubgithub.com/r1skkam/TryHackMe-Atlassian-CVE-2022-26134★ 1githubgithub.com/reubensammut/cve-2022-26134★ 1githubgithub.com/0xAgun/CVE-2022-26134★ 1githubgithub.com/coskper-papa/CVE-2022-26134★ 1githubgithub.com/ma1am/CVE-2022-26134-Exploit-Detection★ 1githubgithub.com/CJ-0107/cve-2022-26134★ 1githubgithub.com/axingde/CVE-2022-26134★ 1githubgithub.com/shamo0/CVE-2022-26134★ 1githubgithub.com/kelemaoya/CVE-2022-26134★ 1githubgithub.com/404fu/CVE-2022-26134-POC★ 1githubgithub.com/Habib0x0/CVE-2022-26134★ 1githubgithub.com/wjlin0/CVE-2022-26134★ 0githubgithub.com/vesperp/CVE-2022-26134-Confluence★ 0githubgithub.com/secjia/CVE-2022-26134★ 0githubgithub.com/sunny-kathuria/exploit_CVE-2022-26134★ 0githubgithub.com/Luchoane/CVE-2022-26134_conFLU★ 0githubgithub.com/shiftsansan/CVE-2022-26134-Console★ 0githubgithub.com/yigexioabai/CVE-2022-26134-cve1★ 0githubgithub.com/xanszZZ/ATLASSIAN-Confluence_rce★ 0githubgithub.com/latings/CVE-2022-26134★ 0githubgithub.com/yyqxi/CVE-2022-26134★ 0githubgithub.com/tpdlshdmlrkfmcla/cve-2022-26134★ 0githubgithub.com/thetowsif/CVE-2022-26134★ 0githubgithub.com/MAHABUB122003/Atlassian-CVE-2022-26134★ 0githubgithub.com/crypt0lith/confluence-ognl-rce★ 0githubgithub.com/roodhelios/CVE-2022-26134-OGNL-Injection★ 0githubgithub.com/Muhammad-Ali007/Atlassian_CVE-2022-26134★ 0githubgithub.com/yTxZx/CVE-2022-26134★ 0githubgithub.com/DARKSTUFF-LAB/-CVE-2022-26134★ 0githubgithub.com/xsxtw/CVE-2022-26134★ 0githubgithub.com/cc3305/CVE-2022-26134★ 0githubgithub.com/Gilospy/CVE-2022-26134★ 0githubgithub.com/Khalidhaimur/CVE-2022-26134★ 0cve_referencepacketstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.htmlnão verificadocve_referencepacketstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.htmlnão verificadocve_referencepacketstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.htmlnão verificadoexploitdbwww.exploit-db.com/exploits/50952não verificadocve_referencepacketstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.htmlnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Quer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →Referências
http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.htmlhttp://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.htmlhttp://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.htmlhttps://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.htmlhttps://jira.atlassian.com/browse/CONFSERVER-79016https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134