Confluence Vulnerability Advisory | June 2022

Threat actors are actively exploiting a vulnerability in on premise Confluence Servers. Here's what you need to know.

Background

On June 2, 2022, Atlassian issued a security advisory for a critical vulnerability, CVE-2022-26134, impacting Atlassian's on premise Confluence Server and Confluence Data Center servers. Confluence is software that allows collaboration using a document and knowledge repository. The vulnerability allows an unauthenticated attacker to gain full access to the Confluence Servers. All supported versions of the products are affected however, it does not impact cloud based Confluence products. 

Quick facts: what you need to know now

• Threat actors are actively scanning and exploiting vulnerable servers. In observed attacks, threat actors are deploying malicious files that allow the attacker to remotely interact with the system.
• An unauthenticated user can execute arbitrary commands on vulnerable servers which grants them full control over the unpatched system. 
• All supported versions of on premise Confluence Server and Data Center servers are impacted.
• Cloud based Confluence products are not affected.

Next Steps for All Confluence Server and Data Center Customers:

1. Immediately patch the vulnerable servers using patches available on the Atlassian advisory.
2. Ensure EDR is deployed to all potentially impacted servers.
3. If you are unable to patch, take the following mitigation steps:
   1. Restrict or disable Confluence Server and Data Center instances from the Internet or
   2. Follow mitigation guidance outlined on the Atlassian advisory.
4. Investigation Steps
   1. Analyze web server logs for suspicious activity.
   2. Search for suspicious Jakarta Server Pages (JSP) files on systems by checking for any indicators of compromise (IOCs) here.
5. All users should monitor updates from Atlassian. 

If you have any questions, please reach out to the Risk + Response Team at services@corvusinsurance.com!