INTERNET STORM CENTER SPOTLIGHT
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
Scans/Exploit Attempts for Atlassian Confluence RCE Vulnerability CVE-2023-22527
Published: 2024-01-22
Last Updated: 2024-01-22 15:20:40 UTC
by Johannes Ullrich (Version: 1)
Last week (January 16th), Atlassian released its January 2024 Security Bulletin. Included with the bulletin was a patch for CVE-2023-22527, a remote code execution vulnerability in Confluence Data Center and Confluence Server. Atlassian assigned a CVSS score of 10.0 to the vulnerability. Exploitation does not require authentication.
The update fixed a template injection vulnerability. Similar vulnerabilities have been patched in Atlassian products in the past. Confluence, like most (all?) Atlassian products are written in Java. Java, particularly the Struts framework, uses OGNL (Object-Graph Navigation Language) to represent Java objects. An attacker able to inject an arbitrary OGNL object can execute Java code.
Yesterday, more details regarding the vulnerability were released, including proof of concept code. The proof of concept code was created by reversing the patch Atlassian had released. The blog post highlighted how the URL can be used to execute arbitrary code.
Following the release of this blog post, we saw an increase in exploit attempts in our honeypots. For example...
Read the full entry: https://isc.sans.edu/diary/ScansExploit+Attempts+for+Atlassian+Confluence+RCE+Vulnerability+CVE202322527/30576/
Update on Atlassian Exploit Activity
Published: 2024-01-23
Last Updated: 2024-01-23 16:06:49 UTC
by Johannes Ullrich (Version: 1)
Exploit activity against Atlassian Confluence servers has exploded since we first discussed it yesterday. The combination of a simple-to-exploit vulnerability and a potential set of high-value targets makes this an ideal vulnerability for many attackers.
It is questionable how many high-value targets are vulnerable. Most organizations have migrated to the Atlassian cloud offerings and do not host tools like Confluence on premises.
One of the first IPs we saw exploit the vulnerability was 38.150.12.131. This IP address started with a simple "cat /etc/shadow" style exploit, likely testing exploitability.
Read the full entry: https://isc.sans.edu/diary/Update+on+Atlassian+Exploit+Activity/30582/
More Scans for Ivanti Connect "Secure" VPN. Exploits Public
Published: 2024-01-18
Last Updated: 2024-01-18 13:54:31 UTC
by Johannes Ullrich (Version: 1)
Exploits around the Ivanti Connect "Secure" VPN appliance, taking advantage of CVE-2023-46805, continue evolving. Late on Tuesday, more details became public, particularly the blog post by Rapid7 explaining the underlying vulnerability in depth [1]. Rapid7 also does a good job walking you through how Ivanti obfuscates the LUKS key in its appliance. This will make it easier for security researchers to inspect the code, hopefully pointing out additional vulnerabilities to Ivanti in the future. In other words, get ready for more Ivanti exploits, and hopefully patches, this year.
Currently, we do see two specific URLs in our honeypots that match Rapid7's analysis...
Read the full entry: https://isc.sans.edu/diary/More+Scans+for+Ivanti+Connect+Secure+VPN+Exploits+Public/30568/