CVE-2021-26084
📋 TL;DR
CVE-2021-26084 is a critical OGNL injection vulnerability in Confluence Server and Data Center that allows unauthenticated attackers to execute arbitrary code on vulnerable instances. This affects organizations running affected versions of Confluence, potentially leading to complete system compromise. The vulnerability is actively exploited in the wild.
💻 Affected Systems
- Confluence Server
- Confluence Data Center
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with attacker gaining full administrative control, data exfiltration, ransomware deployment, and lateral movement to other systems.
Likely Case
Initial foothold leading to web shell installation, credential theft, and deployment of cryptocurrency miners or backdoors.
If Mitigated
Attack blocked at network perimeter or detected by security controls before successful exploitation.
🎯 Exploit Status
Multiple public exploit scripts available. Actively exploited by threat actors including ransomware groups.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.13.23, 7.4.11, 7.11.6, 7.12.5 or later
Vendor Advisory: https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
Restart Required: Yes
Instructions:
1. Backup your Confluence instance. 2. Download appropriate fixed version from Atlassian downloads. 3. Stop Confluence service. 4. Apply patch/upgrade. 5. Restart Confluence service. 6. Verify successful upgrade.
🔧 Temporary Workarounds
Block vulnerable endpoints
allBlock access to /pages/doenterpagevariables.action and similar vulnerable endpoints via web application firewall or reverse proxy
# Example nginx location block:
location ~* /pages/doenterpagevariables\.action {
deny all;
return 403;
}
Network segmentation
linuxRestrict Confluence access to trusted networks only
# Example iptables rule:
iptables -A INPUT -p tcp --dport 8090 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8090 -j DROP
🧯 If You Can't Patch
- Immediately isolate affected systems from internet and untrusted networks
- Implement strict network segmentation and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Confluence version via admin interface or by examining confluence/WEB-INF/lib/confluence-x.x.x.jar versionCheck Version:
grep -o 'confluence-[0-9.]*\.jar' /opt/atlassian/confluence/confluence/WEB-INF/lib/confluence-*.jarVerify Fix Applied:
Verify version is 6.13.23+, 7.4.11+, 7.11.6+, or 7.12.5+ and test vulnerable endpoints return error📡 Detection & Monitoring
Log Indicators:
- POST requests to /pages/doenterpagevariables.action with OGNL payloads
- Unusual Java process execution
- Web shell deployment in web directories
Network Indicators:
- Outbound connections to suspicious IPs from Confluence server
- Unusual HTTP POST patterns to Confluence
SIEM Query:
source="confluence.log" AND (uri_path="/pages/doenterpagevariables.action" OR message="OGNL" OR message="Expression")🔗 References
- http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
- https://jira.atlassian.com/browse/CONFSERVER-67940
- http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
- https://jira.atlassian.com/browse/CONFSERVER-67940
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26084
