Atlassian Confluence Exploit
Share this:
Threat actors were spotted exploiting the CVE-2021-26084 vulnerability in Atlassian’s Confluence enterprise collaboration product. Atlassian released security patches to address the critical flaw earlier last week.
The flaw is an OGNL injection issue that can be exploited by an authenticated attacker to execute arbitrary code on affected Confluence Server and Data Center instances.
An OGNL injection vulnerability exists that would allow an authenticated user, and in some instances unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance.
Atlassian Statement
The issue was discovered through the Atlassian public bug bounty program, the vulnerability received a CVSS score of 9.8.
Affected versions are:
- version < 6.13.23
- 6.14.0 ≤ version < 7.4.11
- 7.5.0 ≤ version < 7.11.5
- 7.12.0 ≤ version < 7.12.5
Threat actors found performing mass scanning and exploit activity targeting Atlassian Confluence servers vulnerable to the above RCE.
Internet scans for systems affected by the CVE-2021-26084 flaw were also spotted by other researchers, the Japan CERT issued a security alert regarding this flaw.
“On September 2, 2021 JPCERT/CC confirmed that an article explaining the details of this vulnerability and PoC code that seems to exploit the vulnerability are made public. The users of the affected products are recommended to take measures such as upgrading to the latest version or apply workaround as soon as possible.”
JPCERT Statement
Experts believe that the number of attacks targeting this Confluence vulnerability will increase in coming weeks.
2 thoughts on “Atlassian Confluence Exploit”