Following a coordinated disclosure of a zero-day vulnerability by Volexity in Atlassian Confluence, now known as CVE-2022-26134, attackers went wild to exploit it. Since the original disclosure and subsequent publication of various proofs of concept, researchers at Barracuda, a trusted partner and leading provider of cloud-first security solutions, have analyzed data from their installations worldwide and discovered large numbers of attempts to exploit this vulnerability. The exploit attempts range from benign reconnaissance to some relatively complex attempts to infect systems with DDoS botnet malware and cryptominers.
Atlassian Confluence is a tool that provides collaborative documentation. On June 2, information about CVE-2022-26134 was publicly released. Over the next weekend, various threat actors used the vulnerability and in no-time malicious actors became aware of it. The vulnerability allows unauthenticated, remote attackers to create new administrative accounts, execute privileged commands, and seize control of the servers.
Initially, Barracuda researchers were seeing a steady flow of attacks attempting to exploit this vulnerability, with several significant spikes. With the continuous monitoring of these attacks, and the pattern, the researchers found that the overall volume dropped slightly in August. Attackers clearly have not given up on trying to exploit this vulnerability.
Exploitation attempts primarily originated from IP addresses in Russia, followed by the U.S., India, Netherlands, and Germany. Previous research showed some of the payloads being delivered and the sources of the attacks.
“There is a steady flow of attacks over time and we foresee a significant amount of scanning and such attempts to continue for the time being.” Sharing his insights on the attack attempts, Tushar Richabadas, Senior Product Marketing Manager, Applications and Cloud Security, Barracuda said, “It’s important to take steps to protect your systems. Now is the ideal time to opt for patching, especially if the system is internet-facing. Placing a web application firewall in front of such systems will provide an in-depth defense against zero-day attacks and other vulnerabilities.”
