CVE-2022-26134

03.06.2022, 22:15

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

Expression Language Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
atlassian	CNA	---				---
CVE	ADP	---				---
CISA-ADP	ADP	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 99%

Vendor	Product	Version
atlassian	confluence_data_center	1.3 ≤ 𝑥 < 7.4.17
atlassian	confluence_data_center	7.13.0 ≤ 𝑥 < 7.13.7
atlassian	confluence_data_center	7.14.0 ≤ 𝑥 < 7.14.3
atlassian	confluence_data_center	7.15.0 ≤ 𝑥 < 7.15.2
atlassian	confluence_data_center	7.16.0 ≤ 𝑥 < 7.16.4
atlassian	confluence_data_center	7.17.0 ≤ 𝑥 < 7.17.4
atlassian	confluence_data_center	7.18.0
atlassian	confluence_server	1.3 ≤ 𝑥 < 7.4.17
atlassian	confluence_server	7.13.0 ≤ 𝑥 < 7.13.7
atlassian	confluence_server	7.14.0 ≤ 𝑥 < 7.14.3
atlassian	confluence_server	7.15.0 ≤ 𝑥 < 7.15.2
atlassian	confluence_server	7.16.0 ≤ 𝑥 < 7.16.4
atlassian	confluence_server	7.17.0 ≤ 𝑥 < 7.17.4
atlassian	confluence_server	7.18.0

𝑥

= Vulnerable software versions

Known Exploits!

Common Weakness Enumeration

CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
The software constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

Vulnerability Media Exposure

References

http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html

http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html

http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html

http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html