Atlassian Confluence OGNL Injection & Setup Bypass (CVE-2022-26134 & CVE-2023-22515)

1. The Targeting of Internal Enterprise Wikis

Atlassian Confluence Server and Data Center power the internal documentation, API architecture blueprints, credentials storage, and disaster recovery runbooks for thousands of technology companies. In 2022 and 2023, two zero-day vulnerabilities in Confluence were weaponized by threat actors to deploy web shells and ransomware (Cerber, Storm-0062) across internal networks: CVE-2022-26134 (OGNL RCE) and CVE-2023-22515 (Broken Access Control in Setup Wizard).

2. CVE Metadata Overview

3. Technical Root Cause: OGNL Evaluation in URI Paths

In CVE-2022-26134, when Confluence processed HTTP requests, unhandled URL path parameters were forwarded to the Webwork framework's translation layers. Webwork passed the URI string directly into an Object-Graph Navigation Language (OGNL) evaluator without sanitization.

An unauthenticated attacker could include a Java runtime expression in the URL path, executing arbitrary shell commands inside the Tomcat container:

GET /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/ HTTP/1.1
Host: wiki.enterprise.com

4. CVE-2023-22515: The Setup Wizard Admin Takeover

In CVE-2023-22515, an unauthenticated attacker accessed /setup/setupadministrator.action by manipulating HTTP headers and session state. The endpoint failed to verify whether initial system installation had already completed, allowing attackers to create a brand new administrative account on live, production Confluence instances.

5. Remediation & Wiki Hardening

1. Upgrade Confluence Server and Data Center to patched release versions immediately (8.5.3+, 8.4.3+, 8.3.4+).
2. Block unauthenticated access to administrative setup paths at your reverse proxy (Nginx / Cloudflare):

   
   location ~* ^/(setup|bootstrap)/ {
       deny all;
       return 403;
   }
   

3. Never expose internal Confluence wikis or Jira portals directly to the public internet; enforce Zero Trust Network Access (ZTNA) or VPN authentication.