Detecting Atlassian Confluence Exploitation - CVE-2022-26134

Context Background

Atlassian has published a security advisory CVE-2022-26134 on June 2, for its Confluence Server and Data Center, regarding zero-day vulnerability. Several customer environments were being compromised with the unauthenticated activity and for which patches were released on June 3 as part of a makeshift solution.

Such a Java vulnerability causes a volatile situation during which a server comes under direct attack. With this exposure, organizations experience data infiltration and other security issues through remote code execution (RCE) resulting in an unauthorized exploitation.

The Impact

If left ignored or unnoticed, the threat actor might make use of the RCE to forcefully induce malware or ransomware to lock or steal data. The impact varies in magnitude and affects at various levels in an organization.

• Server Level – At the server level, this vulnerability creates a devastating effect by completely manipulating the server configurations and settings.
• Domain Level – The infrastructure will be exposed to attacks, eventually resulting in the complete takeover of the customer’s domain.

By injecting Object-Graph Navigation Language (OGNL) into a customer’s development framework, an arbitrary code would be executed making the entire system highly exposed to attacks.

A Constructive Approach for Risk Mitigation & Threat Analysis

CVE-2022-26134, the critical RCE vulnerability, affects all the supported versions of Atlassian Confluence Server and Data Center. In the event, the above patches could not be applied, it is advisable to limit or disable access to the instances.

System-41, a product of Loginsoft, offers Threat Hunting and Detection Rules in “Sigma” (a generic and open signature format) and which later can be converted to any SIEM. The analytics developed will also be validated and the logs used for validation will be preserved for reference. These curated rules will make it easy to analyze various logs as part of identifying a suspicious action or threat across Windows and Linux Operating Systems.

Now, let us try to answer these questions:

• What does the System-41 rule detect in CVE-2022-26134?
• Which logs to look for based on the operating system or server?

What Is detected?

System-41 rule detects suspicious activities, real threats, and any vulnerabilities that hamper proper functioning of your business at server level, network level or OS level.

How is it detected?

Different types of logs are examined during the process of threat identification. These logs differ from one another based on the OS or server.

For instance, the below System-41 rule is written for webserver to observe logs and identify possible threats.

• System-41 rule for webserver

1   title: Confluence Exploit Activity on Webserver Logs
2   id: 646df676-e77e-4021-9127-2156137919ef
3   description: Detection for Confluence server activity found on   webserver logs
4   date: 16/06/2022
5   status: experimental
6   references:
7   - 'https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/'
8   - 'https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/'
9   tags:
10  - attack.t1190
11  author: System-41
12  logsource:
13    category: webserver
14  detection: 
15    mal_request:
16       cs-method: 'GET'
17       c-uri|contains: 
18           - '/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22'
19           - '${@java.lang.Runtime().exec('
20           - '${@java'
21           - '${'
22    condition : mal_request
23  falsepositives: unknown
24  level: high

In the above rule, the logs to be analyzed are detailed from Line 18 to 21. Any unusual activity detected in the Confluence server based on the examination of these logs would be reported.  Alternatively, the detection would take place only if the URI contains any of the parameters defined from Line 18 to 21.

Similarly, there are System-41 rules for Windows and Linux as detailed below.

• System-41 rule for Windows

1   title: Confluence Webshell activity on Windows
2   id: ed473006-e388-4c5d-8672-149c003e569b
3   description: Detection for Confluence activity through tomcat9.exe to run arbitrary commands
4   date: 16/06/2022
5   status: experimental
6   references: https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/
7   tags:
8     -attack.t1033  #System Owner/User Discovery 
9     -attack.t1018  #Remote System Discovery 
10    -attack.t1218.011  #System Binary Proxy Execution: Rundll32 
11    -attack.t1087.001 #Account Discovery: Local Account   
12  author: System-41
13  logsource:
14    category: process_creation
15    product: windows
16  detection:
17    confluence_tomcat_binary:
18      ParentImage|endswith:
19        -'\Confluence\bin\tomcat9.exe'
20    discovery:
21      Image|endswith:
22        -'\whoami.exe'
23        -'\net.exe'
24        -'\net1.exe'
25        -'\schtasks.exe'
26        -'\ping.exe'
27        -'\ipconfig.exe'
28        -'\vssadmin.exe'
29        -'\tasklist.exe'
30        -'\quser.exe'
31        -'\hostname.exe'
32        -'\systeminfo.exe'
33    suspicious_proc:
34      Image|endswith:
35        -'\cmd.exe'
36        -'\powershell.exe'
37        -'\rundll32.exe'
38        -'\fsutils.exe'
39        -'\bitsadmin.exe'
40    condition: confluence_tomcat_binary and (discovery or suspicious_proc)
41  falsepositives: unknown
42  level: high

  

‍

In the above rule, the elements of the map are linked with the logical AND. Next, the image of the process would be matched with that of the parent image. The detection takes place when a log contains the specified image paths.

• System-41 rule for Linux

1   title: Confluence Webshell activity on Linux
2   id: 0d9d7bc8-89f7-4aea-af6d-c5755cbe5c8d
3   description: Detection for Confluence activity through  to run arbitrary commands
4   date: 16/06/2022
5   status: experimental
6   author: System-41
7   refernces: 
8      - 'https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/'
9      - 'https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/'
10  tags: 
11     - attack.t1190 #initial access
12     - attack.t1059  #execution
13  logsource:
14      category: process_creation
15      product: linux
16  detection: 
17      Suscpicious_process_activity:
18         ParentImage|endswith: '/java'
19         ParentImage|startswith: '/opt/atlassian/confluence/'
20         CommandLine|contains:
21         	- '/bin/sh'
22         	- 'curl'
23          - 'wget'
24          - 'pty.spawn'
25          - 'python'
26          - '/bin/bash'
27       condition : Suscpicious_process_activity
28  falsepositives: Unknown
29  level: High

‍

The rule above helps in detecting suspicious process activities in Linux if any of the logs contain requests like ‘curl’ and ‘wget’ in the command line.

Conversion of System-41 rule to SIEM query

Converting the System-41 rule to any SIEM query, it is necessary to include certain parameters like:

• the target SIEM
• a configuration file
• the path

With the inclusion of the above parameters, the command line appears as depicted below.

./sigmac –t <target> -c <path to the configuration file> <path to the rule>

Conclusion

Loginsoft’s team has conducted a detailed research to evolve at solutions that will help in protecting data, be it, on Windows or Linux. System-41 is a threat detection platform from Loginsoft aimed to keep data safe and mitigate risk.

About System-41:

• A threat analytics tool to detect emerging threats, exploits in Wild, latest adversary techniques & malware.
• All the analytics developed will also be validated and the logs used for validation will be preserved for reference.
• The analytics will be developed in “Sigma” (a generic and open signature format) and can be converted to any SIEM queries later.
• With System-41, an enterprise can quickly find the detection of adversary behavior and stream the rules into their workflow.

‍