What this checks: whether an Atlassian Confluence host runs a version affected by unauth OGNL expression-language injection RCE. Read-only: it fingerprints Atlassian Confluence and reads the version, no exploitation.
3. Detection — reads the Atlassian Confluence version from the version exposed at /login.action, compares to 7.4.17 / 7.13.7 / 7.14.3 / 7.15.2 / 7.16.4 / 7.17.4 / 7.18.1 (per branch). Flags vulnerable on an affected build. No exploitation.
1. Target List — paste your Atlassian Confluence URLs here, one per line (e.g. https://host.example.com).
Overview
This workflow finds Atlassian Confluence Server and Data Center and sorts each host by whether its version falls below the CVE-2022-26134 fixed floors. CVE-2022-26134 is unauthenticated OGNL injection that can lead to remote code execution. This check never sends an expression. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs /login.action, fingerprints the product from Confluence markers on that page, reads ajs-version-number, and compares that number to the per-branch table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. There is no confirm step and no OGNL payload.
Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
GET /login.action on each host and fingerprint Confluence from page markers such as ajs-version-number, ajs-build-number, and the powered-by footer.
Parse the version from ajs-version-number and compare it to the CVE-2022-26134 per-branch floors in the graph.
Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, vulnerable, and errors.
Inputs
Target scope. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether Confluence was detected, the version read, the vulnerable flag, and detail text.
findings.jsonl. The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
summary.json. Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.
Integrations
HTTP. Unauthenticated GET of /login.action only. No OGNL expression and no second confirm request.
Sample output
The records below are illustrative and do not come from a real run. They show one Confluence host below a CVE-2022-26134 floor, one at or above its branch floor, and one host that is not the product.
Builds below the per-branch floors in the graph: 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1. A version picks the last band whose start is at or below it, then compares to that band's floor. The compare uses the version Confluence itself served on /login.action.
Does an affected row mean OGNL ran?
No. The check only GETs /login.action and reads ajs-version-number. It does not send an OGNL expression and it does not confirm RCE.
Is this check safe on production?
Yes. It is a read-only unauthenticated GET of the public login page. It does not log in or evaluate OGNL.
Does the check need credentials?
No. It fingerprints the public login page the way an external scanner would.
What is CVE-2022-26134?
Unauthenticated OGNL injection in Atlassian Confluence Server and Data Center that can lead to remote code execution. This workflow maps hosts to that CVE by version exposure only.