News for hackers. Stuff that matters.

A comment on Zero-Day Exploitation of Atlassian Confluence. Parent comment

Re:Zero-Day Exploitation of Atlassian Confluence by bombcar on Friday June 03, 2022 @11:30AM (#31609679)
https://confluence.atlassian.com/doc/confluence-security-adv... is updated with a workaround that you can apply manually now.

Posting this high here so it can be seen.

[ Parent | on HN ]
Re:Zero-Day Exploitation of Atlassian Confluence by yabones on Friday June 03, 2022 @03:56PM (#31612902)
Hacked together a quick and dirty shell script to install on my boxes in a repeatable way... Hope this helps others that find themselves in this situation.

https://gist.github.com/noahbailey/0260efa836b4ea67163cbfeef...

[ Parent | on HN ]
Re:Zero-Day Exploitation of Atlassian Confluence by bombcar on Friday June 03, 2022 @01:20PM (#31611108)
And now the same link has the released update versions. And more details: https://jira.atlassian.com/browse/CONFSERVER-79000
[ Parent | on HN ]
Re:Zero-Day Exploitation of Atlassian Confluence by tyingq on Friday June 03, 2022 @02:22PM (#31611886)
Part of the fix is a patched version of xwork 1.0.3, originally released in 2005, which has had several CVEs past 1.0.3. Yikes.
[ Parent | on HN ]