Zero-Day Exploitation of Atlassian Confluence
Summary: Over the 2022 U.S. Memorial Day weekend, Volexity investigated two internet-facing Atlassian Confluence Server systems where JSP webshells had been written to disk, and traced the compromise to a zero-day that allowed unauthenticated remote code execution, reported to Atlassian on May 31, 2022 and assigned CVE-2022-26134. The attacker loaded a malicious class file in memory, deployed the in-memory BEHINDER implant, then wrote CHINA CHOPPER and a custom file upload shell to disk, with the web server and its child processes running as root.
Why it matters: The exploit worked on fully up-to-date Confluence Server and Data Center versions, including all LTS releases and 7.17.3, and Volexity believes it is in use by multiple threat actors likely originating from China - so patch status alone was no defense.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Mentions
- CVE-2022-26134
- Related
- Grey Noise 2022 Mass Exploitation Report Cyber Risks ·CVE-2022-26134: Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Jun 02, 2022