Skip to content
Naked Security Naked Security

Atlassian announces 0-day hole in Confluence Server – update now!

Zero-day announced - here's what you need to know

Software development and colloboration toolkit behemoth Atlassian is warning of a dangerous zero-day in its collaboration software.

There’s no alert about the bug visible on the company’s main web page, which features the company’s best-known tools JIRA (an IT ticketing system) and Trello (a discussion board), but you’ll find Confluence Security Advisory 2022-06-02 on the Confluence sub-site.

The official bug number is CVE-2022-26134.

The existence of the bug was outed by US threat response company Volexity, which claims to have uncovered the vulnerability while investigating an in-the-wild incident that “included JSP webshells being written to disk”.

Webshells revisited

You’ll remember webshells, no doubt, because they were all over the news just over a year ago during the so-called Hafnium attacks, allegedly conducted by Chinese hackers against Microsoft Exchange servers in March 2021.

Webshells are a nasty way of opening up a backdoor into a network using an attack that sometimes requires attackers to do little more than write one tiny file into part of a web server where content is stored.

In the 1990s, hackers with write access to your website would probably have got their kicks out of adding flaming skulls to your home page, and of drawing immediate public attention to the fact that they’d broken in.

But by adding a web page that includes what’s called a server-side script, today’s attackers can give themselves a secret way into your network without drawing attention to themselves at all.

That’s because a lot of web servers don’t just contain static files that get sent out to remote users when they put in the right URL.

Instead, web servers often rely on files that, when requested by a user, are executed as a program by a scripting engine inside the web server, and used to generate the actual content that gets sent back.

If that sounds dangerous, it is, although it’s generally considered a feature, not a bug.

Indeed, server-side scripting is the background to technologies such as Microsoft’s ASP (active server pages – the name says it all!) and Java’s JSP (Jakarta Server Pages).

As Wikipedia puts it:

JSP […] is a collection of technologies that helps software developers create dynamically generated web pages based on HTML [and] other document types.

Webshells can be as simple as one line of code that does a three-step process like this:

  --> Extract text from the URL or the body of the incoming web request
  --> Run the extracted text itself as a script
  --> Send the output of the rogue script back as the reply

The webshell doesn’t even need to contain any specific malware code of its own that might stand out.

As long as the attacker can control (or even simply guess) the name of the webshell file they’ve implanted, then they can simply visit the server URL that corresponds to that file, any time they like…

…and upload new malware code for immediate execution every time.

Of course, this sort of “run anything you want any time” does tend to leave behind traces that an attacker can’t easily control and that a threat hunter can look out for, such as unexpected error messages, unusual network connections, or non-web-related processes showing up on a web server.

But those artefacts only show up as a side-effect of malicious activity that’s already happened, so the attackers have the upper hand until someone notices something.

What happened?

As you can imagine, Atlassian isn’t giving away any specific information about the bug at this point.

Atlassian originally advised customers to try filtering URLs containing ${, saying that blocking these might “reduce your risk”, though it has now officially withdrawn that suggestion. (See below.)

That makes this bug sound a bit like the infamous Log4Shell hole from the end of 2021, where text that was logged didn’t actually get logged literally if it contained special commands bracketed in ${....} characters.

If you’ve ever used the Bash shell, you’ll be familiar with this sort of “metacommand”. In Bash, the magic brackets are round, not squiggly, so that the text $(runthis) doesn’t get used exactly as it’s written, but instead gets replaced with the output generated by executing the runthis command, which is a very different and much more dangerous thing indeed.

What to do?

Atlassian dubbed this bug Critical, and said it would have a patch out at an “estimated time [of] EOD June 3 PDT”, which was a reassuring yet vague and tautological at the same time.

(The phrase EOD was unspecific in its own right, and didn’t really need the word “estimated” to accompany it.)

Remember that EOD stands for end-of-day, and thus could be as late as one minute to midnight.

And 2022-06-03T23:59 UTC-7 (where PDT is short for Pacific Daylight Time, as used on the West coast of the US during summer) is 2022-06-04T06:59 Zulu time, which was just shy of 8am on Saturday in the UK, and 9am in Western Europe.

Update. Atlassian’s patches are out. All officially supported Confluence Server and Data Center version are affected, and patches have apparently been released for all of these, including versions 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 and 7.18.1. The company has also explained how to carry out a manual “fix” by updating specific Java files yourself if your organisation still has a sluggish process for authorising proper updates. You need to delete two buggy .jar (Java Archive) files and replace them with newer versions, and add one new .class (compiled Java module) file. [Added 2022-06-06T16:00Z.]

Recommended actions include:

  • Patch right away if you can. A formal update is the best choice.
  • Apply Atlassian’s manual fix if you can’t. This is the second-best choice.
  • Take your Confluence servers offline temporarily, if possible, until you have installed the patch.
  • Block open access to your servers directly from the internet if you can.

Note that Atlassian originally suggested a workaround involving blocking incoming URLs that contained the special character sequence ${, assuming that you had a quick and effective way to add a basic filter of this sort.

However, the company has now officially withdrawn this advice, presumably because a proper fix has now been published. (We suspect that a blanket network traffic filter for ${ would be prone not only to missing actual attacks but also to blocking legitimate data, thus producing both false negatives and false positives.)

In short, and as always: Patch early, patch often!

Not enough time or staff?
Learn more about Sophos Managed Detection and Response:
24/7 threat hunting, detection, and response  ▶


Great article! You juste wrote “midight” instead of “midnight” in “thus could be as late as one minute to midight.”


Fixed, thanks! (And thanks for your kind words.)

I was tempted to write “two minutes to midnight”, just so I could link to this:

(Warning. Contains mullets.)


If you’ll pardon a couple tangents inspired by your tangent… I’ll continue waxing nostalgic with ya.
I was reading just yesterday about the Doomsday Clock, which inspired this song, inevitably triggering an obligatory listen.
— — —
Also WRT mullets: Remember the website Mullets Galore dot com?
Sadly it no longer exists, but I found it rather humorous–and even bought the calendar for a friend’s birthday. MG hailed from the early days of the corporate interwebs, along with the dancing CGI baby, Villain Supply, Three Dead Trolls in a Baggie, Napster, and of course Napster Bad.
“Lairs and Bases” was my favorite section on Villain Supply. Prices like
Starts at $149,999,999.99
had me wondering if they might carry a penny for giving proper change.
The features list always included “convenient and obvious self destruct button.”
free digital camera when you get the volcano upgrade!
Both sites are visible-ish in the Wayback Machine–yet mere shells of their former glory.


We’re actually at less than 2 mins to midnight right now… 100 seconds, if memory serves. (It was actually 3 minutes to when the Maiden song came out. It didn’t reach 2 until 2018, after havin last been 2 from 1953 to 1960. Says Wikipedia.)


Right. I was surprised to learn the clock was (relatively) comfortable in 1962/63, expecting the Cuban Missile Crisis to put us at about fifteen seconds prior. But then I read that the clock is adjusted after an annual gathering determines if it’s even necessary. This affords various scenarios time to unfold, explode (if you’ll pardon the expression), and resolve before the clock has time to react.

It would be tedious I suppose, to have a dude sitting there with his finger on the minute hand, reacting to every ripple in the geopolitical quagmire.
And it would also be draining for all us clockwatchers, likely similar to checking one’s portfolio value every ten minutes.


Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!