Patchfirst
Patchfirst
CVE-2021-26084 KEVRansomwarePublic exploit Critical · 9.8 EPSS >99.9%

Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

Atlassian · Confluence Server and Data Center

Summary

Atlassian Confluence Server and Data Center contains an Object-Graph Navigation Language (OGNL) injection flaw, classified as improper neutralization of special elements in an expression language statement. An unauthenticated attacker with network access can exploit it, requiring no user interaction and no special configuration, to execute arbitrary code on the affected instance.

Official description · NVD

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

Breakdown
87.6 / 100
Exploited
Yes, in CISA KEV
Reports
3
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. What they do

  2. What can follow

First seen exploited 9 days after disclosure. Public exploit code (Metasploit) was available 5 days before disclosure.

  1. Public exploit codeMetasploit5 days before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidence+9 days
  4. Added to CISA KEVknown ransomware use; EU database agrees+2 mo
  5. Named in a threat reportmicrosoft.com+21 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order 2

ExecutionTA0002

Command and Scripting Interpreter T1059
MITRE CTID mapping of the KEV entry · primary impact

CVE-2021-26084 is a critical vulnerability affecting Atlassian Confluence Server and Data Center that allows unauthenticated remote code execution. This Object-Graph Navigation Language (OGNL) injection vulnerability enables attackers to execute arbitrary code on vulnerable Confluence instances

ImpactTA0040

Resource Hijacking T1496
MITRE CTID mapping of the KEV entry · follow-on activity

Detection

3 rules for this CVE · 108 general rules for its techniques

Rules for this CVE

3 that reference CVE-2021-26084 directly.

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Command and Scripting InterpreterT105995 general rules
All 95 on SigmaHQ ↗
Resource HijackingT149613 general rules
All 13 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 3 threat reports
3 reportsCISA2MicrosoftJun 2023 · 2 undated

Reports are matched by finding the exact id CVE-2021-26084 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

3 links, grouped by NVD tag (2 duplicates merged)

Vendor Advisory 1

jira.atlassian.com/browse/CONFSERVER-67940

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26084

Third Party Advisory 1

packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
↑ ↓ chooseEnter openEsc close