Threat Advisory: Atlassian Confluence zero-day vulnerability under active exploitation
Summary: Cisco Talos is monitoring active exploitation of a zero-day command injection vulnerability, CVE-2022-26134, in Confluence Data Center and Server, confirmed to affect all supported versions. The attacks delivered payloads including the in-memory BEHINDER implant and webshells such as China Chopper, and researchers confirmed continued exploitation is ongoing with a Proof of Concept now available.
Bottom line: The flaw is an OGNL injection reachable through an HTTP request, with all HTTP methods vulnerable and exploitation described as relatively straightforward - and Atlassian's patches (7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, 7.18.1) only help once applied.