A critical vulnerability in Atlassian’s Confluence Server software is now under active attack.
Disclosed last week by Atlassian, CVE-2021-26084 is a remote code execution bug that is considered a critical security risk by the vendor. The flaw, which was rated a 9.8 on the CVSS scale, is due to an injection bug in the open source Object-Graph Navigation Language (OGNL) discovered and reported by security researcher Benny Jacob through Atlassian’s bug bounty program.
Troy Mursch, chief research officer with threat intelligence vendor Bad Packets, confirmed to SearchSecurity that CVE-2021-26084 was now being targeted in the wild.
“I can confirm Bad Packets honeypots have detected mass scanning and exploit activity targeting the Atlassian Confluence RCE vulnerability CVE-2021-26084 from hosts in Russia, Hong Kong, Brazil, Poland and Romania,” Mursch said. “Multiple proof-of-concepts have been published publicly demonstrating how to exploit this vulnerability.”
Administrators are being urged to update any on-premises versions of Atlassian’s Confluence Server collaboration software as hackers have now descended on the critical security flaw. Cloud-hosted versions of Confluence Server are not vulnerable to attack, Atlassian said.
According to Atlassian, the bug normally requires the attacker to be logged into the network to exploit, but under some circumstances, servers can be remotely exploited without any authentication.
I can confirm Bad Packets honeypots have detected mass scanning and exploit activity targeting the Atlassian Confluence RCE vulnerability CVE-2021-26084 from hosts in Russia, Hong Kong, Brazil, Poland and Romania. Troy MurschChief research officer, Bad Packets
In a demonstration of the flaw, researcher Harsh Jaiswal showed how the bug could be exploited to gain remote code execution.
“From our understanding & debugging we came to this conclusion: Attributes of #tag components within Velocity template are evaluated as OGNL Expressions to convert the template into HTML,” Jaiswal wrote.
For administrators, this means that getting the flaw patched as soon as possible is imperative. In some cases, Mursch said, it may already be too late. While Bad Packets doesn’t have an estimate on the number of vulnerable servers in the wild, the sheer volume of activity against the flaw should make the update a priority.
“Organizations using the on-premises version of Confluence need to immediately apply the update provided by Atlassian and check their servers for any indicators of compromise,” said Mursch.
“Given the level of scanning of exploit activity we’ve detected so far today, any unpatched servers are at immediate risk of compromise.”
MacRumors: Mac News and Rumors – Front Page 24. August 2021 This article has been indexed from MacRumors: Mac News and Rumors – Front Page Apple CEO Tim Cook is set to join other tech executives in a cybersecurity meeting with U.S. President Joe Biden next week, reports Bloomberg. The meeting will focus on the…
Three former US intelligence and military operatives broke America’s weapons export and computer security laws by, among other things, helping the United Arab Emirates hijack and siphon data from people’s iPhones, it emerged on Tuesday. US citizens Marc Baier, 49, and Ryan Adams, 34, and ex-citizen Daniel Gericke, 40, were charged [PDF] with using “illicit,…
Just in time to ruin the holiday weekend, ransomware attackers have apparently used Kaseya — a software platform designed to help manage IT services remotely — to deliver their payload. Sophos director and ethical hacker Mark Loman tweeted about the attack earlier today, and now reports that affected systems will demand $44,999 to be unlocked….
Security company Clario Tech, in conjunction with cyber security researcher Bob Diachenko, discovered a vulnerability within EventBuilder, a virtual events integration tool for Microsoft. Clario notified EventBuilder of the danger earlier this year, and the popular webinar tool, which integrates with Microsoft Teams, has now closed the exposure. Exposing personal details More than one million…
Critical Infrastructure Security , DDoS Protection , Security Operations Alleged Attack Targeted Vulnerable Government Web Servers Prajeet Nair (@prajeetspeaks) • February 23, 2021 Russia is accused of recruiting Ukrainian servers to DDoS Ukraine. (Source: ISMG) Ukraine has accused Russia of turning Ukrainian government servers into a botnet for massive distributed denial-of-service attacks that…
WASHINGTON: Google and Microsoft are at knives drawn. Driven in part by pressure from lawmakers and regulators over the extraordinary power the two technology companies wield over American life, the California-based search engine giant and Washington-based software firm are wrestling to throw each other under the bus. Tensions between Microsoft Corp and Alphabet-owned Google have…
