Atlassian has launched pressing patches for a number of of its merchandise to repair distant code execution and denial-of-service vulnerabilities. Flaws in Atlassian merchandise have been exploited by hackers earlier than, together with shortly after a patch was launched and even earlier than a repair was accessible.
In October, Atlassian launched an emergency repair for a damaged entry management subject (CVE-2023-22515) affecting on-premises variations of Confluence Server and Confluence Knowledge that allowed unauthenticated attackers to create administrator accounts. The vulnerability was already being exploited within the wild as a zero-day when the corporate launched the patch.
In early November, attackers began exploiting one other vital improper authorization vulnerability (CVE-2023-22518) in Confluence Knowledge Middle and Server only some days after the patch was launched. Older Confluence flaws that had been exploited as zero-days or n-days by a number of teams of attackers embrace CVE-2022-26134, CVE-2021-26084, and CVE-2019-3396. Prospects are subsequently urged to use the newly launched December patches as quickly as doable.
Confluence template injection and deserialization flaws
One of many vital vulnerabilities patched final week permits nameless authenticated attackers to inject unsafe code into pages on affected cases of Confluence Knowledge Middle and Confluence Server. Atlassian catalogs this flaw (CVE-2023-22522) as a template injection subject and warns that it might probably result in distant code execution on the server.
The flaw impacts all variations of Confluence Knowledge Middle and Server beginning with 4.0.0 in addition to standalone variations of Confluence Knowledge Middle 8.6.0 and eight.6.1. Most of the affected variations have reached end-of-life and are now not supported. The corporate advises customers of Confluence Server to improve to model 7.19.17 (LTS), 8.4.5 or 8.5.4 (LTS) and Confluence Knowledge Middle customers to improve to model 8.6.2 or 8.7.1. The vulnerability has no different mitigations, however Atlassian advises prospects to again up their occasion and take away it from the web if they’ll’t patch instantly.
One other vital vulnerability patched final week stems from a Java deserialization subject inherited from a third-party parsing library referred to as SnakeYAML. This vulnerability is tracked as CVE-2022-1471 and was patched in SnakeYAML a 12 months in the past. Since then, three different flaws, two excessive severity and one vital, have been reported in SnakeYAML.
