CVE-2022-26134: 
Confluence Server vulnerability analysis and mitigation

CVE-2022-26134 is a critical severity unauthenticated remote code execution vulnerability affecting Atlassian Confluence Server and Data Center. The vulnerability was discovered and disclosed on June 2, 2022, and involves an OGNL injection vulnerability that allows unauthenticated attackers to execute arbitrary code on affected instances. The affected versions range from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1 (Atlassian Advisory).

The vulnerability is an OGNL (Object-Graph Navigation Language) injection vulnerability that affects the HTTP server. The OGNL payload is placed in the URI of an HTTP request, and any type of HTTP method appears to work. The vulnerability stems from the way namespace parameters are processed through TextParseUtil.translateVariables and ultimately evaluated by OgnlValueStack.findValue. The vulnerability has received a CVSS v3.1 base score of 9.8 CRITICAL with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Rapid7 Blog).

The vulnerability allows attackers to execute arbitrary code on affected Confluence Server or Data Center instances with the privileges of the Confluence application. This could lead to complete system compromise, data theft, and persistent system access. The impact is particularly severe as the vulnerability requires no authentication and can be exploited by any remote attacker with network access to the target system (CISA Alert).

Atlassian released patches on June 3, 2022, with fixed versions including 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1. A temporary workaround involving the replacement of the xwork-1.0.3.6.jar file with a newly released xwork-1.0.3-atlassian-10.jar was also provided. Organizations unable to immediately patch were advised to restrict or disable Confluence Server and Data Center instances (Atlassian Advisory).

The vulnerability prompted immediate response from security organizations and government agencies. CISA added the vulnerability to their Known Exploited Vulnerabilities Catalog and issued an alert advising organizations to block all internet traffic to and from affected products until patches could be applied (CISA Alert).