Active Exploitation of Critical Confluence Vulnerability

THE THREAT

eSentire has observed the active exploitation of a recently released critical vulnerability in the Atlassian Confluence platform. CVE-2021-26084 (CVSS: 9.8) was publicly announced on August 25th, 2021. The vulnerability is tracked as a Confluence Server Webwork OGNL injection vulnerability; exploitation allows an adversary to bypass authentication and perform remote code execution on vulnerable devices. CVE-2021-26084 impacts both Confluence Servers and Confluence Data Centers.

eSentire can confirm that exploitation has been ongoing since at least September 1st, 2021. Organizations that have yet to apply the relevant security patches are recommended to do so immediately, as exploitation is ongoing.

What we’re doing about it

• eSentire MDR for Network has rules in place to detect this threat
• Indicators of Compromise (IoCs), associated with observed attacks, have been blocked via eSentire's MDR for Network
• Indicator sweeps have been performed for all eSentire MDR for Endpoint clients

• Any impacted organizations will be notified directly

• eSentire's Managed Vulnerability Service (MVS) has a plugin in place to identify this vulnerability
• eSentire security teams are tracking this threat for additional details and detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches provided by Confluence
• If patching is currently not possible, temporary mitigations are available for both Confluence Servers or Data Center Nodes running on Linux and Windows-based Operating Systems

• Mitigation details and instructions are available in the Confluence vulnerability release

Additional information

Technical details for CVE-2021-26084 and Proof-of-Concept exploit code were publicly released on August 31st. The release of these details significantly reduces the barriers of exploitation for threat actors. Widespread scanning for vulnerable devices has been reported. It is likely that multiple threat actor groups are actively attempting to exploit CVE-2021-26084 for a variety of malicious purposes.

eSentire has observed multiple instances of exploitation. In one case, a cryptocurrency miner was deployed after initial access was gained via exploitation of CVE-2021-26084. In a separate instance observed by eSentire, the adversary attempted to download additional malicious content. The download was blocked by eSentire MDR for Endpoint. Currently, it is unclear what the adversary’s end goal was. This vulnerability may be exploited for a wide variety of malicious purposes ranging from information theft to the deployment of ransomware.

The following table shows both fixed and vulnerable versions of Confluence Servers and Data Centers according to Confluence. It should be noted that Confluence Cloud customers are not affected by CVE-2021-26084.

References:

[1] https://nvd.nist.gov/vuln/detail/CVE-2021-26084
[2] https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
[3] https://www.cyber.gov.au/acsc/view-all-content/alerts/remote-code-execution-vulnerability-present-certain-versions-atlassian-confluence