From 5b46edc201e6e4cc1482d7ae174442f9a9ad57b3 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 3 Jun 2022 21:29:00 -0600 Subject: [PATCH 1/8] Fluent in Confluence --- ...d_remote_code_execution_cve_2022_26314.yml | 72 +++++++++++++++++++ ..._server_and_data_center_cve_2022_26134.yml | 22 ++++++ ...ote_code_execution_cve_2022_26314.test.yml | 13 ++++ 3 files changed, 107 insertions(+) create mode 100644 detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml create mode 100644 stories/atlassian_confluence_server_and_data_center_cve_2022_26134.yml create mode 100644 tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml new file mode 100644 index 0000000000..000e524b61 --- /dev/null +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml @@ -0,0 +1,72 @@ +name: Confluence Unauthenticated Remote Code Execution CVE-2022-26314 +id: fcf4bd3f-a79f-4b7a-83bf-2692d60b859c +version: 1 +date: '2022-06-03' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic assists with identifying CVE-2022-26314 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. + During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. +search: '| tstats count min(_time) as firstTime max(_time) + as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*" + by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype + | `drop_dm_object_name("Web")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `confluence_unauthenticated_remote_code_execution_cve_2022_26314_filter`' +how_to_implement: This detection requires the Web datamodel to be populated from a + supported Technology Add-On like Splunk for Apache or Splunk for Nginx. In addition, network based logs or event data like PAN Threat. +known_false_positives: Tune based on assets if possible, or restrict to known Confluence servers. Remove the ${ for a more broad query. To identify more exec, remove everything up to the last parameter (Runtime().exec) for a broad query. +references: + - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html + - https://www.splunk.com/en_us/blog/security/atlassian-confluence-vulnerability-cve-2022-26134.html + - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/ + - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/ +tags: + analytic_story: + - Atlassian Confluence Server and Data Center CVE-2022-26134 + asset_type: Web Server + cve: + - CVE-2022-26134 + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Update context + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/confluence.log + impact: 100 + kill_chain_phases: + - Exploitation + message: A URL was requested related to CVE-2022-26314, a unauthenticated remote code execution vulnerability, on $dest$ by $src$. + mitre_attack_id: + - T1505 + - T1190 + nist: + - DE.CM + observable: + - name: dest + type: IP Address + role: + - Victim + - name: src + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Web.http_method + - Web.url + - Web.url_length + - Web.src + - Web.dest + - Web.http_user_agent + risk_score: 100 + security_domain: network diff --git a/stories/atlassian_confluence_server_and_data_center_cve_2022_26134.yml b/stories/atlassian_confluence_server_and_data_center_cve_2022_26134.yml new file mode 100644 index 0000000000..b2a7036b12 --- /dev/null +++ b/stories/atlassian_confluence_server_and_data_center_cve_2022_26134.yml @@ -0,0 +1,22 @@ +name: Atlassian Confluence Server and Data Center CVE-2022-26134 +id: 91623a50-41fa-4c4e-8637-c239b80ff439 +version: 1 +date: '2022-06-03' +author: Michael Haag, Splunk +description: On June 2, security researchers at Volexity published a blog outlining the discovery of an unauthenticated remote code execution zero day vulnerability (CVE-2022-26134) being actively exploited in Atlassian Confluence Server and Data Center instances in the wild. Atlassian released a fix within 24 hours of the blog''s release. +narrative: Atlassian describes the vulnerability as an Object-Graph Navigation Language (OGNL) injection allowing an unauthenticated user to execute arbitrary code on a Confluence Server or Data Server instance. Volexity did not release proof-of-concept (POC) exploit code, but researchers there have observed coordinated, widespread exploitation. + Volexity first discovered the vulnerability over the weekend on two Internet-facing web servers running Confluence Server software. The investigation was due to suspicious activity on the hosts, including JSP webshells that were written to disk. +references: + - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html + - https://www.splunk.com/en_us/blog/security/atlassian-confluence-vulnerability-cve-2022-26134.html + - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/ + - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/ +tags: + analytic_story: Atlassian Confluence Server and Data Center CVE-2022-26134 + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Application Security diff --git a/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml b/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml new file mode 100644 index 0000000000..5ec0a58ff2 --- /dev/null +++ b/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml @@ -0,0 +1,13 @@ +name: Confluence Unauthenticated Remote Code Execution CVE-2022-26314 Unit Test +tests: +- name: Confluence Unauthenticated Remote Code Execution CVE-2022-26314 + file: web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: confluence.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/confluence.log + source: pan:threat + sourcetype: pan:threat + update_timestamp: true From a28de38199433639913f7f899472ad4e637badbb Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 3 Jun 2022 21:34:38 -0600 Subject: [PATCH 2/8] tags --- detections/endpoint/java_writing_jsp_file.yml | 1 + ...nce_unauthenticated_remote_code_execution_cve_2022_26314.yml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml index ad7adf98b7..d95f7c766d 100644 --- a/detections/endpoint/java_writing_jsp_file.yml +++ b/detections/endpoint/java_writing_jsp_file.yml @@ -26,6 +26,7 @@ references: tags: analytic_story: - Spring4Shell CVE-2022-22965 + - Atlassian Confluence Server and Data Center CVE-2022-26134 cve: - CVE-2022-22965 asset_type: Endpoint diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml index 000e524b61..30e4c42f3c 100644 --- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml @@ -35,7 +35,7 @@ tags: - CIS 16 confidence: 100 context: - - Update context + - Scope:Network dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/confluence.log impact: 100 From 05cd8a648db02a23dbf08ecb3ddf0041118ad318 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 3 Jun 2022 21:35:48 -0600 Subject: [PATCH 3/8] Update java_writing_jsp_file.yml --- detections/endpoint/java_writing_jsp_file.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml index d95f7c766d..d190e1b7af 100644 --- a/detections/endpoint/java_writing_jsp_file.yml +++ b/detections/endpoint/java_writing_jsp_file.yml @@ -1,12 +1,13 @@ name: Java Writing JSP File id: eb65619c-4f8d-4383-a975-d352765d344b -version: 1 -date: '2022-04-05' +version: 2 +date: '2022-06-03' author: Michael Haag, Splunk type: TTP datamodel: - Endpoint description: The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. + Modify and tune the analytic based on data ingested. For instance, it may be worth running a broad query for jsp file writes first before performing a join. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("java","java.exe", "javaw.exe") by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats From 3891cbcd0f222fdebb2aac548e99b0901312c004 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Sat, 4 Jun 2022 16:56:27 -0600 Subject: [PATCH 4/8] Update confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml --- ...nce_unauthenticated_remote_code_execution_cve_2022_26314.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml index 30e4c42f3c..217c89eadb 100644 --- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml @@ -9,7 +9,7 @@ datamodel: description: The following analytic assists with identifying CVE-2022-26314 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. search: '| tstats count min(_time) as firstTime max(_time) - as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*" + as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*" Web.url="*org.apache.commons.io.IOUtils%40*") by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` From 6d56a434359c6fb18586bb0cd74908d8be9bc855 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 6 Jun 2022 07:46:17 -0600 Subject: [PATCH 5/8] Update confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml --- ...unauthenticated_remote_code_execution_cve_2022_26314.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml index 217c89eadb..7acaf4514f 100644 --- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml @@ -6,10 +6,10 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic assists with identifying CVE-2022-26314 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. - During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. +description: The following analytic assists with identifying CVE-2022-26314 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. This analytic is written against multiple proof of concept codes released and see in the wild (scanning). + During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. search: '| tstats count min(_time) as firstTime max(_time) - as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*" Web.url="*org.apache.commons.io.IOUtils%40*") + as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*") OR (Web.url="*getEngineByName*" AND Web.url="*nashorn*" AND Web.url="*ProcessBuilder*") by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` From 9f2943793d1f199513df4f38fc1fe38842012b9f Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 6 Jun 2022 11:45:12 -0600 Subject: [PATCH 6/8] fixed cve number --- ...unauthenticated_remote_code_execution_cve_2022_26314.yml | 6 +++--- ...henticated_remote_code_execution_cve_2022_26314.test.yml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml index 7acaf4514f..630c635ba3 100644 --- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml @@ -1,4 +1,4 @@ -name: Confluence Unauthenticated Remote Code Execution CVE-2022-26314 +name: Confluence Unauthenticated Remote Code Execution CVE-2022-26134 id: fcf4bd3f-a79f-4b7a-83bf-2692d60b859c version: 1 date: '2022-06-03' @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic assists with identifying CVE-2022-26314 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. This analytic is written against multiple proof of concept codes released and see in the wild (scanning). +description: The following analytic assists with identifying CVE-2022-26134 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. This analytic is written against multiple proof of concept codes released and see in the wild (scanning). During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*") OR (Web.url="*getEngineByName*" AND Web.url="*nashorn*" AND Web.url="*ProcessBuilder*") @@ -41,7 +41,7 @@ tags: impact: 100 kill_chain_phases: - Exploitation - message: A URL was requested related to CVE-2022-26314, a unauthenticated remote code execution vulnerability, on $dest$ by $src$. + message: A URL was requested related to CVE-2022-26134, a unauthenticated remote code execution vulnerability, on $dest$ by $src$. mitre_attack_id: - T1505 - T1190 diff --git a/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml b/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml index 5ec0a58ff2..b8104e23fc 100644 --- a/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml +++ b/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml @@ -1,7 +1,7 @@ -name: Confluence Unauthenticated Remote Code Execution CVE-2022-26314 Unit Test +name: Confluence Unauthenticated Remote Code Execution CVE-2022-26134 Unit Test tests: -- name: Confluence Unauthenticated Remote Code Execution CVE-2022-26314 - file: web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml +- name: Confluence Unauthenticated Remote Code Execution CVE-2022-26134 + file: web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From e28a396af4267eee37450b01866651b73eae2375 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 6 Jun 2022 11:46:49 -0600 Subject: [PATCH 7/8] cve fix2 --- ...ce_unauthenticated_remote_code_execution_cve_2022_26134.yml} | 2 +- ...authenticated_remote_code_execution_cve_2022_26134.test.yml} | 0 2 files changed, 1 insertion(+), 1 deletion(-) rename detections/web/{confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml => confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml} (99%) rename tests/web/{confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml => confluence_unauthenticated_remote_code_execution_cve_2022_26134.test.yml} (100%) diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml similarity index 99% rename from detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml rename to detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml index 630c635ba3..17c3aaf755 100644 --- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml @@ -14,7 +14,7 @@ search: '| tstats count min(_time) as firstTime max(_time) | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `confluence_unauthenticated_remote_code_execution_cve_2022_26314_filter`' + | `confluence_unauthenticated_remote_code_execution_cve_2022_26134_filter`' how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache or Splunk for Nginx. In addition, network based logs or event data like PAN Threat. known_false_positives: Tune based on assets if possible, or restrict to known Confluence servers. Remove the ${ for a more broad query. To identify more exec, remove everything up to the last parameter (Runtime().exec) for a broad query. diff --git a/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml b/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.test.yml similarity index 100% rename from tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml rename to tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.test.yml From 6b84ec3bf3023cb65845deb960fedea4914cf601 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 6 Jun 2022 12:48:32 -0700 Subject: [PATCH 8/8] Update confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml --- ...nce_unauthenticated_remote_code_execution_cve_2022_26134.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml index 17c3aaf755..dd0f5134ec 100644 --- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic assists with identifying CVE-2022-26134 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. This analytic is written against multiple proof of concept codes released and see in the wild (scanning). +description: The following analytic assists with identifying CVE-2022-26134 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. This analytic is written against multiple proof of concept codes released and seen in the wild (scanning). During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*") OR (Web.url="*getEngineByName*" AND Web.url="*nashorn*" AND Web.url="*ProcessBuilder*")