mitre / mitre/secure-coding-case-studies
Proposal: CVE-2022-26134 (OGNL Injection in Atlassian Confluence)
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 11
- Forks
- 45
- PR merge metrics
- No merged PRs in 30d
Description
Description:
We propose to create a secure coding case study on CVE-2022-26134, an OGNL injection vulnerability in Atlassian Confluence that allows remote code execution.
The core coding mistake was improper handling and evaluation of user-supplied input. The application allowed untrusted input to be interpreted as an OGNL expression, leading to arbitrary command execution on the server.
Attackers could exploit this by crafting malicious HTTP requests containing OGNL expressions, which were evaluated by the server without sufficient validation.
This case study will focus on the coding mistake, how the vulnerability was exploited, and how it was fixed at the code level by restricting expression evaluation and improving input validation.
Team Members:
- Purna Adithya Akula (G01588237)
- Veera Venkata Satya Siddhartha Gopalam (G01551529)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file, test, or entry point is named. Start by reviewing the repository’s existing case studies and the CVE-2022-26134 description, then define the case study’s structure and code-level scope. Done means a complete, reviewable study explaining the OGNL injection, exploitation path, coding mistake, and stated remediation.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100