CVE-2022-26134: Confluence OGNL injection, check and fix
Last updated:
An OGNL injection in Confluence Server and Data Center lets anyone who reaches the site run code on it, without logging in: the attacker puts an OGNL expression in the URL path, as in /${…}/, and Confluence evaluates it.
It was exploited as a zero-day before Atlassian published the advisory on 2 June 2022, and CISA added it to KEV the same day. Confluence Cloud is not affected.
At a glance
- CVE
- CVE-2022-26134
- Software
- Atlassian Confluence Server and Data Center
- Affected versions
- From 1.3.0, every version before the fixed release of its line
- Fixed in
- 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, 7.18.1
- CVSS score
- 9.8 Critical (NVD, CVSS 3.1) ·
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CISA Known Exploited Vulnerabilities
- Yes, added on June 2, 2022
- Published by NVD
- June 3, 2022
- InfraFence virtual patch
vp-cve-2022-26134(ModSecurity id 9920005)
What is affected
Every Confluence Server and Data Center version from 1.3.0 before the fixed release of its line: 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 and 7.18.1. Versions out of support at the time got no fix: they need an upgrade to a supported line.
Check whether a server is vulnerable
Confluence shows its version in the footer of every page and under Administration › General Configuration › System Information. Compare it with the fixed releases above.
Attempts carry ${ in the path, often encoded as %24%7B. Search the access logs of the proxy in front of Confluence, and Confluence's own access logs in its logs folder:
sudo grep -rhiE '%24%7B|\$\{' --include='*access*' --exclude='*.gz' /var/log/apache2 /var/log/httpd 2>/dev/null | tail -20Fix it
- Upgrade to a fixed release, best the latest Long Term Support release of a supported line, following Atlassian's upgrade guide (back up the database and the home folder first).
- If you cannot upgrade at once, Atlassian published a temporary workaround that replaces the
xwork(and for older versionswebwork) jar files: follow the steps for your version in the advisory linked below, on every node of a cluster. - Until one of the two is done, keep the instance off the internet: CISA asked agencies to block traffic to and from unpatched instances.
Warning: A server that was reachable before the fix may already be compromised: look for unknown processes and web shells in the Confluence folders, and check the logs from late May 2022 onwards.
How InfraFence blocks it while you update
The virtual patch for CVE-2022-26134 is a ModSecurity rule on the decoded request path: it blocks any path that contains ${. Confluence URLs do not use that sequence in the path; the query string is not checked.
Note: It protects Confluence only when the requests go through Apache with ModSecurity on the same server, as a reverse proxy. Direct access to Confluence's own port bypasses it: close that port to the internet.
How the patch is applied
- The agent notes which SSH ports and sites answer.
- It writes the rule (ModSecurity id 9920005) between its own markers in its ModSecurity file, runs
apachectl configtestand reloads Apache gracefully. A failed test puts the previous file back. - It checks that SSH and the sites still answer, and removes the patch if they do not.
- It checks that ModSecurity really blocks with the rule, with a harmless local probe request. A ModSecurity in
DetectionOnlyonly logs: the patch is then removed and reported as ineffective, never as applied.
Every request the patch blocks is reported with CVE-2022-26134 (agent 1.0.37 or later): you see the attempts on the server's activity and on the Exploitation page of the dashboard, so you know the vulnerability is being tried against you.
Warning: A virtual patch blocks the known form of the attack on the requests that go through Apache on that server. It is not a substitute for the update: install the fixed version, then remove the patch from Activity with Undo if you no longer need it.
Virtual patches need Apache with ModSecurity, the setting Allow web server configuration changes, and no hosting panel or configuration manager in charge of the web server; they are part of the Pro plan and AutoMode. A person applies them from the AI analysis, or AutoMode does. See Virtual patches.
Sources
The facts on this page come from these sources; check them for changes.
Try it free on 1 server
Starter is free for one server, with full protection and automatic blocking. No credit card.
Install the agent as root, with your token in place of <TOKEN>:
curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash -s -- --token <TOKEN>The token is created in the dashboard, in Servers › Add server.