CVE-2022-26134 - Confluence RCE

Atlassian has been made aware of the current active exploitation of a critical severity unauthenticated remote code execution vulnerability in Confluence Data Center and Server. The OGNL injection vulnerability allows an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance. **All** versions of Confluence Server and Data Center prior to the fixed versions listed above are affected by this vulnerability. Atlassian has released the following versions to address this issue: **Released versions 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1 which contain a fix for this issue.** This playbook includes the following tasks: * Collect detection rules. * Exploitation patterns & IoCs hunting using PANW Next-Generation Firewalls and 3rd party SIEM products. * Cortex Xpanse policies coverage. * Provides Atlassian workarounds and patched versions. **More information:** [Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022-26134) ](https://unit42.paloaltonetworks.com/cve-2022-26134-atlassian-code-execution-vulnerability/) [Confluence Security Advisory 2022-06-02](https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html) **Note:** This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.

CVE-2022-26134 - Confluence RCE · 51 tasks · 7 inputs · 0 outputs

Details

IDCVE-2022-26134 - Confluence RCE
From Version6.2.0
To Version6.4.9
Tasks51

README

Atlassian has been made aware of the current active exploitation of a critical severity unauthenticated remote code execution vulnerability in Confluence Data Center and Server. The OGNL injection vulnerability allows an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance.

All versions of Confluence Server and Data Center prior to the fixed versions listed above are affected by this vulnerability.

Atlassian has released the following versions to address this issue:

Released versions 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1 which contain a fix for this issue.

This playbook includes the following tasks:

  • Collect detection rules.
  • Exploitation patterns & IoCs hunting using PANW Next-Generation Firewalls and 3rd party SIEM products.
  • Cortex Xpanse policies coverage.
  • Provides Atlassian workarounds and patched versions.

More information:

Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022-26134)

Confluence Security Advisory 2022-06-02

Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • PAN-OS - Block Domain - External Dynamic List
  • Palo Alto Networks - Hunting And Threat Detection
  • QRadar Indicator Hunting V2
  • Block Indicators - Generic v2
  • QRadar search for suspicious Java child process
  • Panorama Query Logs
  • Splunk Indicator Hunting

Integrations

  • Elasticsearch v2

Scripts

  • ParseHTMLIndicators
  • IsIntegrationAvailable
  • http

Commands

  • extractIndicators
  • associateIndicatorsToIncident
  • search
  • expanse-get-issues
  • closeInvestigation
  • createNewIndicator
  • splunk-search

Playbook Inputs

Name Description Default Value Required
SplunkEarliestTime Splunk search earliest time. -7d@d Optional
SplunkLatestTime Splunk search latest time. now Optional
SplunkIndex The Splunk index field to search in.
Default is “*”		 * Optional
EDLDomainBlocklist The EDL domain blocklist name.   Optional
BlockIndicatorsAutomatically Whether to block the indicators automatically or not. True Optional
QRadarTimeRange The time range for QRadar query. Last 7 DAYS Optional
ElasticIndex Elastic’s index name in which to search.   Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

CVE-2022-26134 - Confluence RCE

Inputs

  • SplunkEarliestTime — Splunk search earliest time.
  • SplunkLatestTime — Splunk search latest time.
  • SplunkIndex — The Splunk index field to search in. Default is "*"
  • EDLDomainBlocklist — The EDL domain blocklist name.
  • BlockIndicatorsAutomatically — Whether to block the indicators automatically or not.
  • QRadarTimeRange — The time range for QRadar query.
  • ElasticIndex — Elastic's index name in which to search.

Commands used

associateIndicatorsToIncident closeInvestigation createNewIndicator expanse-get-issues extractIndicators search splunk-search

Flowchart

true false true true false true true true true false true Start Start Collect Indicators Collect Indicators Extract Indicators Extract Indicators Extract Indicators From Data Collected - extractIndicators Extract Indicators From D... extractIndicators Tag and Link Indicators Tag and Link Indicators Link Indicators To Incident - associateIndicatorsToIncident Link Indicators To Incident associateIndicatorsToIncident Tag IP indicators - createNewIndicator Tag IP indicators createNewIndicator Tag CVE indicators - createNewIndicator Tag CVE indicators createNewIndicator Download Yara Rules - http Download Yara Rules http Download Sigma Rules - http Download Sigma Rules http Collect Detection Rules Collect Detection Rules Collect indicators from Volexity - ParseHTMLIndicators Collect indicators from V... ParseHTMLIndicators Collect indicators from PicusSecurity - ParseHTMLIndicators Collect indicators from P... ParseHTMLIndicators Tag File indicators - createNewIndicator Tag File indicators createNewIndicator SIEM Advanced Hunting SIEM Advanced Hunting Is Splunk Enabled? - IsIntegrationAvailable Is Splunk Enabled? IsIntegrationAvailable Is QRadar Enabled? Is QRadar Enabled? Splunk search for suspicious Java child process - splunk-search Splunk search for suspici... splunk-search QRadar search for suspicious Java child process - QRadarFullSearch QRadar search for suspici... QRadarFullSearch Elastic search for suspicious Java child process - search Elastic search for suspic... search Is Elastic Enabled? - IsIntegrationAvailable Is Elastic Enabled? IsIntegrationAvailable Splunk Indicator Hunting - Splunk Indicator Hunting Splunk Indicator Hunting Splunk Indicator Hunting QRadar Indicator Hunting V2 - QRadar Indicator Hunting V2 QRadar Indicator Hunting V2 QRadar Indicator Hunting V2 Threat Hunting Threat Hunting Palo Alto Networks Hunting Palo Alto Networks Hunting Palo Alto Networks - Hunting And Threat Detection - Palo Alto Networks - Hunting And Threat Detection Palo Alto Networks - Hunt... Palo Alto Networks - Hunting ... Panorama Query Logs - Panorama Query Logs Panorama Query Logs Panorama Query Logs Xpanse Xpanse Is Xpanse enabled? Is Xpanse enabled? Search for possible vulnerable servers using Xpanse - expanse-get-issues Search for possible vulne... expanse-get-issues Review possible vulnerable servers Review possible vulnerabl... Found servers using Xpanse? Found servers using Xpanse? Remediation Remediation Block Indicators - Generic v2 - Block Indicators - Generic v2 Block Indicators - Generi... Block Indicators - Generic v2 Block indicators automatically? Block indicators automati... Block indicators manually Block indicators manually PAN-OS - Block Domain - External Dynamic List - PAN-OS - Block Domain - External Dynamic List PAN-OS - Block Domain - E... PAN-OS - Block Domain - Exter... Mitigation Mitigation Install Confluence patched versions Install Confluence patche... Recommended workaround for Confluence 7.15.0-7.18.0 Recommended workaround fo... Atlassian suggested workarounds Atlassian suggested worka... Patch Vulnerability Patch Vulnerability Deploy Detection Rules Deploy Detection Rules Sigma Rules Sigma Rules Yara Rules Yara Rules Recommended workaround for Confluence 7.0.0-7.14.2 Recommended workaround fo... Analysis resolution - Should continue with the investigation? Analysis resolution - Sho... Done Done Investigate Further Investigate Further Close Investigation - closeInvestigation Close Investigation closeInvestigation Resolution Resolution

Source

playbook-CVE-2022-26134_-_Confluence_RCE.yml playbook-CVE-2022-26134_-_Confluence_RCE_6_5.yml playbook-CVE-2022-26134_-_Confluence_RCE_6_5_README.md
Download History Raw 
Atlassian has been made aware of the current active exploitation of a critical severity unauthenticated remote code execution vulnerability in Confluence Data Center and Server. The OGNL injection vulnerability allows an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance. 

**All** versions of Confluence Server and Data Center prior to the fixed versions listed above are affected by this vulnerability.

Atlassian has released the following versions to address this issue:

**Released versions 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1 which contain a fix for this issue.**

This playbook includes the following tasks:

* Collect detection rules.
* Exploitation patterns & IoCs hunting using PANW Next-Generation Firewalls and 3rd party SIEM products.
* Cortex Xpanse policies coverage.
* Provides Atlassian workarounds and patched versions.

**More information:**

[Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022-26134)
](https://unit42.paloaltonetworks.com/cve-2022-26134-atlassian-code-execution-vulnerability/)
[Confluence Security Advisory 2022-06-02](https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html)

**Note:** This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

* QRadar Indicator Hunting V2
* Panorama Query Logs
* Palo Alto Networks - Hunting And Threat Detection
* Splunk Indicator Hunting
* Block Indicators - Generic v3
* QRadar search for suspicious Java child process

### Integrations

* Elasticsearch v2

### Scripts

* http
* IsIntegrationAvailable
* ParseHTMLIndicators

### Commands

* extractIndicators
* expanse-get-issues
* closeInvestigation
* createNewIndicator
* splunk-search
* search
* associateIndicatorsToIncident

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| SplunkEarliestTime | Splunk search earliest time. | -7d@d | Optional |
| SplunkLatestTime | Splunk search latest time. | now | Optional |
| SplunkIndex | The Splunk index field to search in.<br/>Default is "\*" | * | Optional |
| EDLDomainBlocklist | The EDL domain blocklist name. |  | Optional |
| BlockIndicatorsAutomatically | Whether to block the indicators automatically or not. | True | Optional |
| QRadarTimeRange | The time range for QRadar query. | Last 7 DAYS | Optional |
| ElasticIndex | Elastic's index name in which to search. |  | Optional |
| UserVerification | Possible values: True/False.<br/>Whether to provide user verification for blocking IPs. <br/><br/>False - No prompt will be displayed to the user.<br/>True - The server will ask the user for blocking verification and will display the blocking list. | False | Optional |
| AutoBlockIndicators | <br/>Should the given indicators be automatically blocked, or should the user be given the option to choose?<br/><br/>If set to True - no prompt will appear, and all provided indicators will be blocked automatically.<br/>If set to False - the user will be prompted to select which indicators to block. | True | Optional |

## Playbook Outputs

---
There are no outputs for this playbook.

## Playbook Image

---

![CVE-2022-26134 - Confluence RCE](../doc_files/CVE-2022-26134_-_Confluence_RCE.png)