CVE-2022-26134-Atlassian Confluence RCE 취약점

https://thehackernews.com/2022/06/hackers-exploiting-unpatched-critical.html?m=1

Hackers Exploiting Unpatched Critical Atlassian Confluence Zero-Day Vulnerability

https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/

Zero-Day Exploitation of Atlassian Confluence | Volexity

https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html

Confluence Security Advisory 2022-06-02 | Confluence Data Center and Server 7.18 | Atlassian Documentation

PoC 코드 https://attackerkb.com/topics/BH1D56ZEhs/cve-2022-26134/rapid7-analysis

완화 방법

For Confluence 7.15.0 - 7.18.0
If you run Confluence in a cluster, you will need to repeat this process on each node. You don't need to shut down the whole cluster to apply this mitigation.
1. Shut down Confluence.

2. Download the following 1 file to the Confluence server:
xwork-1.0.3-atlassian-10.jar

3. Delete (or move the following JAR outside of the Confluence install directory):
<confluence-install>/confluence/WEB-INF/lib/xwork-1.0.3-atlassian-8.jar
(warning) Do not leave a copy of this old JAR in the directory.

4. Copy the downloaded xwork-1.0.3-atlassian-10.jar into <confluence-install>/confluence/WEB-INF/lib/

5. Check the permissions and ownership on the new xwork-1.0.3-atlassian-10.jar file matches the existing files in the same directory.

6. Start Confluence
For Confluence 7.0.0 - Confluence 7.14.2
If you run Confluence in a cluster, you will need to repeat this process on each node. You don't need to shut down the whole cluster to apply this mitigation.
1. Shut down Confluence.

2. Download the following 3 files to the Confluence server:
xwork-1.0.3-atlassian-10.jar
webwork-2.1.5-atlassian-4.jar
CachedConfigurationProvider.class

3. Delete (or move the following JARs outside of the Confluence install directory):

4. <confluence-install>/confluence/WEB-INF/lib/xwork-1.0.3.6.jar
<confluence-install>/confluence/WEB-INF/lib/webwork-2.1.5-atlassian-3.jar
(warning) Do not leave a copy of the old JARs in the directory.

5. Copy the downloaded xwork-1.0.3-atlassian-10.jar into <confluence-install>/confluence/WEB-INF/lib/

6. Copy the downloaded webwork-2.1.5-atlassian-4.jar into <confluence-install>/confluence/WEB-INF/lib/

7. Check the permissions and ownership on both new files matches the existing files in the same directory.

8. Change to directory <confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup

9. Create a new directory called webwork
Copy CachedConfigurationProvider.class into <confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup/webwork
Ensure the permissions and ownership are correct for:
<confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup/webwork
<confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup/webwork/CachedConfigurationProvider.class
Start Confluence.

패치버전
7.4.17
7.13.7
7.14.3
7.15.2
7.16.4
7.17.4
7.18.1