CVE-2022-26134
Quick assessment
Affected
Atlassian Confluence Data Center
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Atlassian Confluence Server是澳大利亚Atlassian公司的一套具有企业知识管理功能，并支持用于构建企业WiKi的协同软件的服务器版本。 Atlassian Confluence Server 和 Data Center 存在注入漏洞。攻击者利用该漏洞执行任意代码。以下产品及版本受到影响：1.3.0版本至7.4.17之前版本、7.13.0版本至7.13.7之前版本、7.14.0版本至7.14.3之前版本、7.15.0版本至 7.15.2之前版本、7.16.0版本至7.16.4之
Public Exploits 3
ExploitDB · 1
EDB-50952 [webapps]
Metasploit · 1
atlassian_confluence_namespace_ognl_injection.rb [exploit]
Nuclei · 1
CVE-2022-26134.yaml [template]
In-the-Wild Activity Observed
cisa_kev · confirmed
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-26134
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Atlassian Confluence Server 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Atlassian Confluence Server是澳大利亚Atlassian公司的一套具有企业知识管理功能，并支持用于构建企业WiKi的协同软件的服务器版本。 Atlassian Confluence Server 和 Data Center 存在注入漏洞。攻击者利用该漏洞执行任意代码。以下产品及版本受到影响：1.3.0版本至7.4.17之前版本、7.13.0版本至7.13.7之前版本、7.14.0版本至7.14.3之前版本、7.15.0版本至 7.15.2之前版本、7.16.0版本至7.16.4之
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Atlassian | Confluence Data Center | next of 1.3.0 ~ unspecified | - |
|
| Atlassian | Confluence Server | next of 1.3.0 ~ unspecified | - |
|
II. Public POCs for CVE-2022-26134
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | 【懒人神器】一款图形化、批量采集url、批量对采集的url进行各种nday检测的工具。可用于src挖掘、cnvd挖掘、0day利用、打造自己的武器库等场景。可以批量利用Actively Exploited Atlassian Confluence 0Day CVE-2022-26134和DedeCMS v5.7.87 SQL注入 CVE-2022-23337。 | https://github.com/W01fh4cker/Serein | POC Details |
| 2 | Information and scripts for the confluence CVE-2022-26134 | https://github.com/offlinehoster/CVE-2022-26134 | POC Details |
| 3 | 0-DAY: Unauthenticated Remote Code Execution in Atlassian Confluence (CVE-2022-26134). | https://github.com/CyberDonkyx0/CVE-2022-26134 | POC Details |
| 4 | This repository contains Yara rule and the method that a security investigator may want to use for CVE-2022-26134 threat hunting on their Linux confluence servers. | https://github.com/th3b3ginn3r/CVE-2022-26134-Exploit-Detection | POC Details |
| 5 | CVE-2022-26134 Proof of Concept | https://github.com/jbaines-r7/through_the_wire | POC Details |
| 6 | CVE-2022-26134 - Confluence Pre-Auth RCE | OGNL injection | https://github.com/crowsec-edtech/CVE-2022-26134 | POC Details |
| 7 | None | https://github.com/kyxiaxiang/CVE-2022-26134 | POC Details |
| 8 | （CVE-2022-26134）an unauthenticated and remote OGNL injection vulnerability resulting in code execution in the context of the Confluence server | https://github.com/Brucetg/CVE-2022-26134 | POC Details |
| 9 | Confluence Server and Data Center - CVE-2022-26134 - Critical severity unauthenticated remote code execution vulnerability PoC | https://github.com/shamo0/CVE-2022-26134 | POC Details |
| 10 | [CVE-2022-26134]Confluence OGNL expression injected RCE with sandbox bypass. | https://github.com/SNCKER/CVE-2022-26134 | POC Details |
| 11 | None | https://github.com/Sakura-nee/CVE-2022-26134 | POC Details |
| 12 | None | https://github.com/Vulnmachines/Confluence-CVE-2022-26134 | POC Details |
| 13 | Atlassian confluence poc | https://github.com/axingde/CVE-2022-26134 | POC Details |
| 14 | CVE-2022-26134 | https://github.com/1rm/Confluence-CVE-2022-26134 | POC Details |
| 15 | None | https://github.com/0xAgun/CVE-2022-26134 | POC Details |
| 16 | None | https://github.com/abhishekmorla/CVE-2022-26134 | POC Details |
| 17 | Confluence Pre-Auth Remote Code Execution via OGNL Injection (CVE-2022-26134) | https://github.com/h3v0x/CVE-2022-26134 | POC Details |
| 18 | This repository talks about Zero-Day Exploitation of Atlassian Confluence, it's defense and analysis point of view from a SecOps or Blue Team perspective | https://github.com/archanchoudhury/Confluence-CVE-2022-26134 | POC Details |
| 19 | Simple Honeypot for Atlassian Confluence (CVE-2022-26134) | https://github.com/SIFalcon/confluencePot | POC Details |
| 20 | None | https://github.com/PsykoDev/CVE-2022-26134 | POC Details |
| 21 | None | https://github.com/vesperp/CVE-2022-26134-Confluence | POC Details |
| 22 | Atlassian Confluence 远程代码执行漏洞（CVE-2022-26134） | https://github.com/li8u99/CVE-2022-26134 | POC Details |
| 23 | Implementation of CVE-2022-26134 | https://github.com/reubensammut/cve-2022-26134 | POC Details |
| 24 | None | https://github.com/BeichenDream/CVE-2022-26134-Godzilla-MEMSHELL | POC Details |
| 25 | CVE-2022-26134 Confluence OGNL Injection POC | https://github.com/alcaparra/CVE-2022-26134 | POC Details |
| 26 | Exploit for CVE-2022-26134: Confluence Pre-Auth Remote Code Execution via OGNL Injection | https://github.com/whokilleddb/CVE-2022-26134-Confluence-RCE | POC Details |
| 27 | Atlassian Confluence- Unauthenticated OGNL injection vulnerability (RCE) | https://github.com/Habib0x0/CVE-2022-26134 | POC Details |
| 28 | None | https://github.com/Y000o/Confluence-CVE-2022-26134 | POC Details |
| 29 | Atlassian confluence unauthenticated ONGL injection remote code execution scanner (CVE-2022-26134). | https://github.com/redhuntlabs/ConfluentPwn | POC Details |
| 30 | CVE-2022-26134 | https://github.com/cai-niao98/CVE-2022-26134 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-26134
请登录查看更多情报信息。
Exploits & Public PoCs for CVE-2022-26134 (3)
Other References for CVE-2022-26134 (2)
-
https://jira.atlassian.com/browse/CONFSERVER-79016 x_refsource_MISC
IV. Related Vulnerabilities
V. Comments for CVE-2022-26134
No comments yet