ZeroHour
Palo Alto Unit 42published ()ingested Unit 42

Threat Brief: CVE-2021

highVulnerability exploited in the wildimportance 60CVE-2021-26084

Vulnerabilities mentionedAll →

CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2021-26084
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

CVE-2021-26084 is an OGNL injection vulnerability (CWE-917) in Atlassian Confluence Server and Data Center that may allow an unauthenticated attacker to execute arbitrary code. Any organization running Confluence Server or Data Center is potentially affected. It is significant because it is listed in CISA's Known Exploited Vulnerabilities catalog with known ransomware use, and EPSS assigns a 100.0% probability of exploitation within 30 days (100th percentile).

Do: Apply updates to Confluence Server and Data Center per Atlassian's instructions, which is the required action in the CISA KEV listing. Prioritize remediation given confirmed in-the-wild exploitation and known ransomware use.

9.8100% KEV ransomware PoC
  • Atlassian Confluence Server and Data Center
Full article353 words · extracted from unit42.paloaltonetworks.com · click to collapse

Executive Summary

On Aug. 25, 2021, Atlassian released a security advisory for an injection vulnerability in Confluence Server and Data Center, CVE-2021-26084. If the vulnerability is exploited, threat actors could bypass authentication and run arbitrary code on unpatched systems. Since the release of this advisory, mass scanning activity has started to occur, seeking unpatched systems, and in-the-wild exploitation has begun. Unit 42 recommends customers upgrade to the latest release of Confluence Server and Data Center.

Vulnerable Systems

The Atlassian products vulnerable to CVE-2021-26084 are those using the following versions of Confluence Server and Data Center:

  • All 4.x.x versions.
  • All 5.x.x versions.
  • All 6.0.x versions.
  • All 6.1.x versions.
  • All 6.2.x versions.
  • All 6.3.x versions.
  • All 6.4.x versions.
  • All 6.5.x versions.
  • All 6.6.x versions.
  • All 6.7.x versions.
  • All 6.8.x versions.
  • All 6.9.x versions.
  • All 6.10.x versions.
  • All 6.11.x versions.
  • All 6.12.x versions.
  • All 6.13.x versions before 6.13.23.
  • All 6.14.x versions.
  • All 6.15.x versions.
  • All 7.0.x versions.
  • All 7.1.x versions.
  • All 7.2.x versions.
  • All 7.3.x versions.
  • All 7.4.x versions before 7.4.11.
  • All 7.5.x versions.
  • All 7.6.x versions.
  • All 7.7.x versions.
  • All 7.8.x versions.
  • All 7.9.x versions.
  • All 7.10.x versions.
  • All 7.11.x versions before 7.11.6.
  • All 7.12.x versions before 7.12.5.

Confluence Cloud customers are not affected by this vulnerability.

Mitigation Actions

We recommend that customers update Atlassian Confluence Server and Data Center to the latest version, 7.13.0 (TLS). You can find the newest release on Atlassian’s download center.

If you cannot install the latest upgrade, see the Mitigation section on the Atlassian security advisory for information on how to mitigate this vulnerability by running a script for the operating system your Confluence server is hosted on.

Conclusion

Palo Alto Networks provides protection against the exploitation of this vulnerability:

  • Next-Generation Firewalls with a Threat Prevention security subscription (running Applications and Threat content update version 8453) can automatically block sessions related to this vulnerability using Threat ID 91594.

Palo Alto Networks will update this Threat Brief with new information and recommendations as they become available.

Additional Resources

writeups/Confluence-RCE.md at main · httpvoid/writeups

Confluence Server Download Archives

Confluence Security Advisory - 2021-08-25 | Confluence Data Center and Server 7.13

Text extracted automatically; images, tables and formatting may be missing. Original: https://unit42.paloaltonetworks.com/cve-2021-26084/