Security News > 2022 > June > Linux botnets now exploit critical Atlassian Confluence bug

Linux botnets now exploit critical Atlassian Confluence bug
2022-06-08 18:22

Several botnets are now using exploits targeting a critical remote code execution vulnerability to infect Linux servers running unpatched Atlassian Confluence Server and Data Center installs.

After proof-of-concept exploits were published online, cybersecurity firm GreyNoise said it detected an almost ten-fold increase in active exploitation, from 23 IP addresses attempting to exploit it to more than 200.

Kinsing has also targeted Confluence in the past using another critical Atlassian Confluence RCE flaw to install cryptomining malware after a PoC exploit was released online.

One day after this actively exploited bug was disclosed, Atlassian released security updates and urged customers to patch their installations to block ongoing attacks.

"We strongly recommend upgrading to a fixed version of Confluence as there are several other security fixes included in the fixed versions of Confluence," Atlassian said.

If you can't immediately upgrade your Confluence install, you can also use a temporary workaround that requires updating some JAR files on the Confluence server, as detailed here.


News URL

https://www.bleepingcomputer.com/news/security/linux-botnets-now-exploit-critical-atlassian-confluence-bug/

Related vendor

VENDOR LAST 12M #/PRODUCTS LOW MEDIUM HIGH CRITICAL TOTAL VULNS
Linux 11 64 2532 1569 67 4232
Atlassian 58 3 259 104 46 412