Confluence - RCE Detection Scenario by crowdsecurity | CrowdSec Hub

Confluence - RCE

Attack scenariohttp:exploitMITRE T1595MITRE T1190cve.CVE-2022-26134

By: crowdsecurity
Version: 0.4
Name: crowdsecurity/CVE-2022-26134
Remediation: Ban

Confluence - RCE (CVE-2022-26134)

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/whm

Installs 18 parsers and 66 scenarios, via HTTP - CVE Detection.

View WHM →

Installation

sudo cscli scenarios install crowdsecurity/CVE-2022-26134

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/CVE-2022-26134.yaml· 19 linesGitHub

1type: trigger1
2#debug: true
3name: crowdsecurity/CVE-2022-26134
4description: "Confluence - RCE (CVE-2022-26134)"
5filter: "Upper(PathUnescape(evt.Meta.http_path)) contains Upper('@java.lang.Runtime@getRuntime().exec(')"2
6blackhole: 1m3
7groupby: "evt.Meta.source_ip"4
8labels:
9  type: exploit
10  remediation: true5
11  classification:6
12    - attack.T1595
13    - attack.T1190
14    - cve.CVE-2022-26134
15  spoofable: 0
16  confidence: 3
17  behavior: "http:exploit"
18  service: confluence
19  label: "Confluence - RCE"

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

CVE-2022-26134

Detects attempts of exploit of CVE-2022-26134 RCE vulnerability.

Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26134