Skip to content

Instantly share code, notes, and snippets.

@Shivammalaviya

Shivammalaviya/Confluence Zero Day Remote Code Execution

Created June 7, 2022 16:07
Show Gist options
  • Save Shivammalaviya/27d5609496d035816068588e81408873 to your computer and use it in GitHub Desktop.
Save Shivammalaviya/27d5609496d035816068588e81408873 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Confluence Zero Day Remote Code Execution
let CVE202226134 = externaldata(ip:string)[@"https://gist.githubusercontent.com/Shivammalaviya/8529563a6d4dca8a3617b79272d87d68/raw/47eafc8d2038b32a641022ed3dbe8b290dfd24cf/CVE-2022-26134%2520IPs"]
| distinct ip;
CVE202226134
| join (DeviceNetworkEvents
| where ActionType in ("ConnectionSuccess","InboundConnectionAccepted","ConnectionFound")
)
on $left.ip == $right.RemoteIP
| project Timestamp,LocalIP,RemoteIP,DeviceName,RemoteUrl,InitiatingProcessFileName,ActionType
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment