Atlassian Confluence bug CVE-2022-26134 exploited in cryptocurrency mining campaign

Threat actors are targeting unpatched Atlassian Confluence servers as part of an ongoing crypto mining campaign.

Trend Micro researchers warn of an ongoing crypto mining campaign targeting Atlassian Confluence servers affected by the CVE-2022-26134 vulnerability.

The now-patched critical security flaw was disclosed by Atlassian in early June, at the time the company warned of a critical unpatched remote code execution vulnerability affecting all Confluence Server and Data Center supported versions that is being actively exploited in attacks in the wild.

“We observed the active exploitation of CVE-2022-26134, an unauthenticated remote code execution (RCE) vulnerability with a critical rating of 9.8 in the collaboration tool Atlassian Confluence. The gap is being abused for malicious cryptocurrency mining.” reads the post published by Trend Micro. “If left unremedied and successfully exploited, this vulnerability could be used for multiple and more malicious attacks, such as a complete domain takeover of the infrastructure and the deployment information stealers, remote access trojans (RATs), and ransomware.”

In one of the attacks spotted by the experts, threat actors exploited the flaw to inject an OGNL expression and download and run a shell script (“ro.sh”) on the victim’s machine. Then the script was used to fetch a second shell script (“ap.sh”).

The ap.sh shell script was used to perform multiple actions, including the update of the path variable to include the /tmp and /dev/shm paths, downloading the curl utility, disabling the iptablesor changes the firewall policy action to ACCEPTand flushes all the firewall rules.

The script also downloads a binary file named ko, which exploits the PwnKit vulnerability to escalate the privilege to the root user, while the binary file downloads the ap.sh shell script for the next actions.

The last stage of the attack chain consists in downloading the hezb malware and kills processes that are associated with other competing coin miners.

The shell script also disables cloud service provider agents from Alibaba and Tencent, then performs lateral movement via SSH.

Threat actors were also spotted deploying additional malicious payloads, including Kinsing and the Dark.IoT malware.

“Although we have observed the abuse of this vulnerability for illicit cryptocurrency-mining activities by cybercriminals, we also urge users to prioritize patching this gap as soon as possible since it is fairly simple to exploit it for other subsequent compromises.” concludes the report. “Attackers could take advantage of injecting their own code for interpretation and gain access to the Confluence domain being targeted, as well as conduct attacks ranging from controlling the server for subsequent malicious activities to damaging the infrastructure itself.”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Atlassian Confluence)

---