Categories: Technology

Critical Atlassian 0-day is under active exploit. You’re patched, right?

[ad_1]

About this time last week, threat actors began quietly tapping a previously unknown vulnerability in Atlassian software that gave them almost complete control over a small number of servers. Since Thursday, active exploits of the vulnerability have mushroomed, creating a semi-organized frenzy among competing crime groups.

“It is clear that multiple threat groups and individual actors have the exploit and have been using it in different ways,” said Steven Adair, president of Volexity, the security firm that discovered the zero-day vulnerability while responding to a customer’s breach over the Memorial Day weekend. “Some are quite sloppy and others are a bit more stealth.” His tweet came a day after his firm released the report detailing the vulnerability.

Adair also said that the industry verticals being hit “are quite widespread. This is a free-for-all where the exploitation seems coordinated.”

CVE-2022-26134, as the vulnerability is tracked, allows for unauthenticated remote code execution on servers running all supported versions of Confluence Server and Confluence Data Center. In its advisory, Volexity called the vulnerability “dangerous and trivially exploited.” The vulnerability is likely also present in unsupported and long-term support versions, security firm Rapid7 said.

Volexity researchers wrote:

When initially analyzing the exploit, Volexity noted it looked similar to previous vulnerabilities that have also been exploited in order to gain remote code execution. These types of vulnerabilities are dangerous, as attackers can execute commands and gain full control of a vulnerable system without credentials as long as web requests can be made to the Confluence Server system. It should also be noted that CVE-2022-26134 appears to be another command injection vulnerability. This type of vulnerability is severe and demands significant attention.

Threat actors are exploiting the vulnerability to install the Chopper webshell and likely other types of malware. Here’s hoping vulnerable organizations have already patched or otherwise addressed this hole and, if not, wishing them good luck this weekend. Atlassian’s advisory is here.

[ad_2]
Source link
Admin

Recent Posts

Kijangwin is the latest online video gaming provider

Kijangwin is your brand-new go-to destination for all things internet gaming. Whether you're an informal…

2 days ago

How to Style Trendy Clothes Effortlessly

Hey there, fashion enthusiasts! Are you ready to dive into the world of trendy clothes…

3 days ago

How to effectively recover your frozen/stolen funds from fraudulent platforms

Hey there! If you're reading this, there's a good chance you've found yourself in the…

3 days ago

Important things about Core 2 . 0 regarding Hemp Users

Hey there, hemp enthusiasts! If you've been on the hunt for the next big thing…

5 days ago

Exploring the Features and Benefits of Strio

Hey there! Have you ever found yourself tangled up in the world of communication and…

1 week ago

The Importance of Pre-Sale Pest Control: Ensuring a Smooth Home Transaction

Are you worried that hidden critters might derail your home sale? Selling a house can…

1 week ago