Confluence Vulnerability - Executive Summary
- Atlassian Confluence, a collaborative team workspace used by half of Fortune 500 companies, has been impacted by a critical-severity vulnerability (tracked as CVE-2022-26134) allowing for ransomware deployment, data theft, and more.
- Reports indicate that attackers are actively exploiting the vulnerability to deploy ransomware. Other exploitation attempts appear to be connected to a criminal cryptocurrency mining group based in China.
- Based on Bitsight’s observations, global vulnerability remediation is taking place but many organizations may still be vulnerable to CVE-2022-26134. Bitsight observes more than 60% of at-risk organizations in the United States and EMEA are no longer operating a vulnerable version of Confluence, while only 45% of at-risk organizations outside of these regions are no longer operating a vulnerable version.
- Because of the widespread usage of Confluence, this vulnerability represents a significant supply chain risk to many organizations; Bitsight observes that 199,000 companies are dependent on at least one potentially vulnerable organization. Organizations should evaluate their risk and exposure even if they do not directly use Confluence.
- To remediate the vulnerability, Atlassian urges users to upgrade to the latest version. If you cannot upgrade at this time, then Atlassian recommends a temporary mitigation involving updating specific files for the specific product version.
The Confluence vulnerability (CVE-2022-26134) is being actively exploited by cybercriminals, and you may be affected even if you do not use the software. Bitsight has uncovered that nearly 200,000 organizations are associated with at least one organization potentially vulnerable to CVE-2022-26134. If your organization shares data with a third party using Confluence, then your data may be at risk of disclosure and/or encryption. Now is a critical time to educate yourself on the topic, and prepare for future vulnerabilities.
What is Confluence?
Confluence is a collaborative team workspace developed by Australian software firm Atlassian. Firms may choose to store a wide variety of sensitive information on Confluence including trade secrets, patent filings, employee personal information, financial data, customer information, and planned business decisions.
What is the new Confluence vulnerability (tracked as CVE-2022-26134) and how could it affect my organization?
Atlassian’s Confluence Server and Confluence Data Center products have been impacted by a critical-severity remote code execution (RCE) zero-day vulnerability allowing an unauthenticated attacker to remotely take over servers hosting vulnerable Confluence versions. Attackers can achieve control of the server via creating new administrative accounts and executing arbitrary code.
Successful attacks can lead to ransomware deployment and data theft, and such attacks have already begun. Reports indicate that ransomware groups AvosLocker and Cerber2021 are actively exploiting the vulnerability, while some of the exploitation attempts appear to be connected to a Chinese cryptocurrency mining gang called the 8220 Mining Group. Given the use-case of Confluence as a company-wide information chest of sorts, the prospect of ransomware and data theft are serious. Adding to these concerns is the potential for business disruption and increased utility costs which could come into play if an attacker successfully exploits CVE-2022-26134 to implant cryptocurrency mining malware onto your machines.
Proof-of-concept (POC) exploits have already been made public, lowering the sophistication threshold required for threat actors to exploit CVE-2022-26134. This vulnerability is therefore surprisingly easy to exploit.
What are the supply chain implications of CVE-2022-26134?
Under these circumstances, third-party risk management (TPRM) should be top of mind for all organizations. Even if your organization does not use Confluence, you may still be affected via your supply chain. In fact, Bitsight observes that 199,000 organizations have an association with at least one potentially vulnerable organization.
The third-party supply chain implications are clear. Imagine you shared confidential intellectual property documentation with one of your third parties, like your company’s law firm. If the law firm used Confluence to store your sensitive information, then threat actors exploiting CVE-2022-26134 could gain access to your data via your legal firm and threaten to publicly share your confidential documents if you do not pay a ransom. Similarly, if you shared sensitive financial information or confidential business plans with another member of your supply chain then a threat actor could attack your vendor, encrypt your files, and demand a ransom for their decryption. Cybercriminals with a target in mind will often identify weak links within the target’s supply chain, opting to attack the target’s third parties as a way to obtain the target’s information for malicious purposes. CVE-2022-26134 serves as an example of a vulnerability that threat actors seek to exploit for these purposes.
Now is a good time to systematically reach out to your third parties to learn more about their use of Confluence and to obtain a better understanding of what data you have shared with them.
