Following a coordinated disclosure of a zero-day vulnerability by Volexity in Atlassian Confluence, now known as CVE-2022-26134, attackers went wild to exploit it. Since the original disclosure and subsequent publication of various proofs of concept, researchers at Barracuda, a trusted partner and leading provider of cloud-first security solutions, have analyzed data from their installations worldwide and discovered many attempts to exploit this vulnerability. The exploit attempts range from benign reconnaissance to some relatively complex attempts to infect systems with DDoS botnet malware and cryptominers.
Atlassian Confluence is a tool that provides collaborative documentation. On June 2, information about CVE-2022-26134 was publicly released. Over the next weekend, various threat actors used the vulnerability and in no-time malicious actors became aware of it. The vulnerability allows unauthenticated, remote attackers to create new administrative accounts, execute privileged commands, and seize control of the servers.
Exploitation attempts primarily originated from IP addresses in Russia, followed by the U.S., India, Netherlands, and Germany. Previous research showed that attacks originating from U.S. IP addresses are primarily from cloud providers. Similarly, for Germany, most attacks were from hosting providers.
“There is a steady flow of attacks over time and we foresee a significant amount of scanning and such attempts to continue for the time being.” Sharing his insights on the attack attempts, Tushar Richabadas, Senior Product Marketing Manager, Applications and Cloud Security, Barracuda said, “It’s important to take steps to protect your systems. Now is the ideal time to opt for patching, especially if the system is internet-facing. Placing a web application firewall in front of such systems will provide an in-depth defense against zero-day attacks and other vulnerabilities.”
