4 ms·

Both Atlassian and CISA are recommending either disconnecting servers from the internet or shutting them off entirely. I don't like the sounds of this. https:/

• bombcar 4y ago
  Which is very strange, they usually have at least a workaround or URL to block.
  • throwaway939343 4y ago
    Sorry what now? You cannot simply block the current attackers control addresses (they actually do give you these) or domains. First they could be either VPN users or "residential proxies" aka legitimate people with a botnet on their pc. Second the attacker - or anyone else who now knows it exists - can just change URLs or IPs. They can change the exploit signature so anti-virus and IDS systems can't trivially see it. The ONLY correct solution here is to bring the servers offline until there is a patched version to upgrade to. Anything else would be a terrible idea. _sometimes_ there is only one config setting that's affected, or some other often lesser-used feature that can be disabled. But it highly depends on the method used.
    • eps 4y ago
      GP meant that oftentimes exploits use a specific entry point on the public surface and blocking access to it acts as a stop-gap measure.
  • yardstick 4y ago
    They’ve suggested blocking ${ in the request
    • Icingdeath 4y ago
      Using nginx in front of my local confluence server (not listening on the internet) and used the following: location ~\* \$\{. { deny all; } but this only helps if this vulnerability is triggered using the request uri otherwise it's useless
      • bombcar 4y ago
        Anyone know how you'd quote it for Apache rewrite? RewriteEngine On RewriteCond %{REQUEST_URI} ^.*\${.*$ RewriteRule ^/(.*) https://google.com [R=302,L] seems to work ...
    • justin_oaks 4y ago
      The security advisory from Atlassian says blocking ${ "may reduce your risk". That's a far cry from being a fix.
      • technion 4y ago
        I really worry about these sort of claims. I'm seeing pushback from people about shutting servers down because it's insisted "a WAF is protecting us now", and that's based on a "may reduce risk".
        • richbell 4y ago
          Same issue with log4shell. "Why are you bugging us? We already applied <mitigation posted 2 weeks ago that has since been disproven>."
        • tyingq 4y ago
          I would worry about just using that blocking pattern. They mention OGNL injection and ${ is just one pattern you can go after. There's also #{, %{, #var, and more.
    • jpetrucc 4y ago
      posting a snippet for HAProxy in case its helpful to someone else (or if others have recommendations on how to better do this) http-request deny if { path -m sub ${ } http-request deny if { query -m sub ${ } http-request deny if { path -m sub $%7B } http-request deny if { query -m sub $%7B } http-request deny if { path -m sub %24%7B } http-request deny if { query -m sub %24%7B }
  • justin_oaks 4y ago
    There are now manual steps for mitigating the vulnerability. See https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html https://confluence.atlassian.com/doc/confluence-security-adv... It is strange that they didn't have mitigation steps earlier, but I'm guessing Atlassian announced this immediately since it was already being exploited.
• bombcar 4y ago
  https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html https://confluence.atlassian.com/doc/confluence-security-adv... is updated with a workaround that you can apply manually now. Posting this high here so it can be seen.
  • deleted 4y ago
    [deleted]
  • bombcar 4y ago
    And now the same link has the released update versions. And more details: https://jira.atlassian.com/browse/CONFSERVER-79000 https://jira.atlassian.com/browse/CONFSERVER-79000
    • tyingq 4y ago
      Part of the fix is a patched version of xwork 1.0.3, originally released in 2005, which has had several CVEs past 1.0.3. Yikes.
  • yabones 4y ago
    Hacked together a quick and dirty shell script to install on my boxes in a repeatable way... Hope this helps others that find themselves in this situation. https://gist.github.com/noahbailey/0260efa836b4ea67163cbfeef579b93a https://gist.github.com/noahbailey/0260efa836b4ea67163cbfeef...