Security News > 2022 > June > Linux botnets now exploit critical Atlassian Confluence bug
Several botnets are now using exploits targeting a critical remote code execution vulnerability to infect Linux servers running unpatched Atlassian Confluence Server and Data Center installs.
After proof-of-concept exploits were published online, cybersecurity firm GreyNoise said it detected an almost ten-fold increase in active exploitation, from 23 IP addresses attempting to exploit it to more than 200.
Kinsing has also targeted Confluence in the past using another critical Atlassian Confluence RCE flaw to install cryptomining malware after a PoC exploit was released online.
One day after this actively exploited bug was disclosed, Atlassian released security updates and urged customers to patch their installations to block ongoing attacks.
"We strongly recommend upgrading to a fixed version of Confluence as there are several other security fixes included in the fixed versions of Confluence," Atlassian said.
If you can't immediately upgrade your Confluence install, you can also use a temporary workaround that requires updating some JAR files on the Confluence server, as detailed here.
News URL
Related news
- New Linux Kernel Exploit Technique 'SLUBStick' Discovered by Researchers (source)
- Ivanti warns of critical vTM auth bypass with public exploit (source)
- Atlassian Confluence Vulnerability Exploited in Crypto Mining Campaigns (source)
- Week in review: SonicWall critical firewalls flaw fixed, APT exploits WPS Office for Windows RCE (source)
- New Linux Malware Campaign Exploits Oracle Weblogic to Mine Cryptocurrency (source)
- Exploit code released for critical Ivanti RCE flaw, patch now (source)
- That doomsday critical Linux bug: It's CUPS. Could lead to remote hijacking of devices (source)
- That doomsday critical Linux bug: It's CUPS. May lead to remote hijacking of devices (source)
- Critical Linux CUPS Printing System Flaws Could Allow Remote Command Execution (source)