Cloudflare customers are protected from the Atlassian Confluence CVE-2022-26134

Cloudflare Blocks Critical Confluence RCE Exploit

On June 2, 2022, Atlassian disclosed a critical severity vulnerability in Confluence Server and Data Center, tracked as CVE-2022-26134. The flaw is an unauthenticated remote code execution vulnerability affecting all versions of Confluence Server and Data Center greater than 1.3.0.

Atlassian has released a patch, and all organizations running the affected products should update to the latest version available from the official download center. Atlassian also recommends implementing a web application firewall (WAF) rule to block URLs containing ${, which may reduce the risk of compromise.

Protection for Cloudflare Customers

Cloudflare customers using either the WAF or Access are already shielded from exploitation attempts. Cloudflare reviewed the advisory, conducted its own analysis, and prepared an emergency WAF mitigation rule, deployed on June 2, 2022, at 23:38 UTC with a default action of BLOCK.

The rule is available under two IDs, depending on the WAF product in use:

• 100531 for the legacy WAF
• 408cff2b for the new WAF

All websites protected by the Cloudflare WAF, including free plans securing self-hosted Confluence applications, received automatic protection as soon as the new rule went live.

Cloudflare also confirmed that its own Confluence nodes are shielded by both WAF and Access. At the time of writing, there is no evidence that its Confluence instance was exploited.

Access as a Zero Trust Alternative

Organizations that deployed Cloudflare Access in front of Confluence applications were protected from external attempts even before the emergency rule. Access verifies each request against an authenticated user session, meaning unauthenticated attackers would be blocked before ever reaching the Confluence server.

For those not yet using zero trust rules, administrators can enable Access in a few minutes by following the official setup instructions.

Timeline of Events