Zero-Day Exploitation of Atlassian Confluence

Re:Zero-Day Exploitation of Atlassian Confluence by justin_oaks on Friday June 03, 2022 @09:29AM (#31607952)

The security advisory from Atlassian says blocking ${ "may reduce your risk". That's a far cry from being a fix.

[ Parent | on HN ]

Re:Zero-Day Exploitation of Atlassian Confluence by technion on Friday June 03, 2022 @09:39AM (#31608104)

I really worry about these sort of claims. I'm seeing pushback from people about shutting servers down because it's insisted "a WAF is protecting us now", and that's based on a "may reduce risk".

[ Parent | on HN ]

Re:Zero-Day Exploitation of Atlassian Confluence by tyingq on Friday June 03, 2022 @03:48PM (#31612813)

I would worry about just using that blocking pattern. They mention OGNL injection and ${ is just one pattern you can go after. There's also #{, %{, #var, and more.

[ Parent | on HN ]

Re:Zero-Day Exploitation of Atlassian Confluence by richbell on Friday June 03, 2022 @11:21AM (#31609524)

Same issue with log4shell. "Why are you bugging us? We already applied <mitigation posted 2 weeks ago that has since been disproven>."

[ Parent | on HN ]