9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2022-26134

CVE-2022-26134: In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists...

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2022-26134

CVE-2022-26134:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2022-26134, is a critical OGNL injection flaw in Atlassian Confluence. The root cause lies within the XWork/WebWork web framework, a dependency of Confluence. The vulnerability is triggered when an attacker sends a specially crafted HTTP request with a malicious OGNL expression embedded in the URL's namespace.

The core of the vulnerability is that the framework evaluates the namespace from the URL as an OGNL expression. This behavior is present in the com.opensymphony.xwork.ActionChainResult.execute method. This method takes the namespace attribute of an ActionChainResult and passes it to com.opensymphony.xwork.util.TextParseUtil.translateVariables for OGNL evaluation. An unauthenticated attacker can craft a URL that causes the framework to use the malicious namespace, leading to remote code execution.

The mitigation provided by Atlassian involves replacing the vulnerable xwork and webwork JAR files with patched versions. The patch introduces a com.atlassian.confluence.setup.webwork.CachedConfigurationProvider class, which suggests that the fix involves changes to how action configurations are loaded and cached, likely to disable or sanitize OGNL evaluation for namespaces.

During an exploit, a runtime profiler would show a call stack including the entry point of the request (likely com.opensymphony.webwork.dispatcher.ServletDispatcher), leading to the action processing logic, and culminating in the call to com.opensymphony.xwork.ActionChainResult.execute, which in turn calls com.opensymphony.xwork.util.TextParseUtil.translateVariables to execute the malicious OGNL payload.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.