TTP Tuesday: Is CVE-2022-26134 patched on Confluence?

OGNL injection allows unauthenticated remote code execution

This week, we are releasing two TTPs:

• Is CVE-2022-26134 patched on Confluence?

• Are you protected against Ryuk Ransomware?

Is CVE-2022-26134 patched on Confluence?

This vulnerability allows unauthenticated arbitrary code execution on Confluence Server & Data Center. It does this by taking advantage of how OGNL, an Expression Language for Java objects, evaluates user-supplied data.

OGNL injection is an example of server-side template injection which is when an attacker exploits a template syntax bug to inject code into the template engine. Template engines are used to generate web pages and other dynamic content via a special template syntax that substitutes values into a parameterized syntax template. A familiar example may be the Jinja templating library in Python or Mustache for JavaScript.

In Confluence Server and Data Center, from 1.3.0 before 7.4.17 and affecting other LTS releases up to 7.18.1, an OGNL vulnerability exists that allows an unauthenticated user to remotely execute code on the server. The exploit requires sending an HTTP GET request to the Confluence Server using a specially crafted URL containing the template engine exploit. When Confluence handles this GET request the template engine executes the template code and no further user interaction is required.

Testing

Execute this TTP on each Confluence Server instance in your environment to see if you are vulnerable.

The TTP is configured to send a GET request to localhost using the default Confluence Server port 8090. Depending on your Confluence configuration, and whether this TTP is being run on the server or remotely, it may be necessary to adjust the URL in the TTP file. When the exploit is successful the GET response will contain a special `X-Prelude-Response: CVE-2022-26134` header.

Vulnerability scanners typically test this CVE by relying on remote exploitation of the Confluence Server via the specially crafted request. For example, if a server is running a Confluence instance, it will craft a specific HTTP GET request with the malicious code to see if it executes. This will expose whether the Confluence instance can be exploited.

Remediation

Upgrade Confluence Server & Data Center to the latest version. Atlassian has published a security advisory with instructions for patching and a temporary mitigation if patching is not an option.

Are you protected against Ryuk Ransomware?

Ryuk is a ransomware binary that encrypts a file system. This ransomware was used in attacks that targeted the public health sector. CISA released an advisory in late 2020 regarding the Ryuk ransomware.

Testing

This TTP uses a defanged (non-malicious) version of Ryuk which is executed on the local host. This should trigger multiple detections on the host. Detections can occur during the download, the writing of the file to disk, and/or the execution of the defanged ransomware.

Remediation

Modify your endpoint detection rules to alert on the following behaviors: file download, file write, execution of the defanged Ryuk version

Check out “Is CVE-2022-26134 patched on Confluence?” on the Prelude chains website.

Get our products

Download Prelude Operator: https://www.prelude.org/download
See the latest kill chain and TTP Releases: https://chains.prelude.org
See our open-source repositories: https://github.com/preludeorg

Join our community

Discord: https://discord.gg/gzUv4XNquu
Reddit: https://www.reddit.com/r/preludeorg/
Twitter: https://twitter.com/preludeorg

Read, watch, and listen

Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: https://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg

Follow our team

David: https://twitter.com/privateducky
Alex: https://twitter.com/khyberspache
Kris: https://twitter.com/Xanthonus
Octavia: https://twitter.com/VV_X_7
Sam: https://twitter.com/wasupwithuman