A critical vulnerability in Atlassian’s Confluence Server software is now under active attack.
Disclosed last week by Atlassian, CVE-2021-26084 is a remote code execution bug that is considered a critical security risk by the vendor. The flaw, which was rated a 9.8 on the CVSS scale, is due to an injection bug in the open source Object-Graph Navigation Language (OGNL) discovered and reported by security researcher Benny Jacob through Atlassian’s bug bounty program.
Troy Mursch, chief research officer with threat intelligence vendor Bad Packets, confirmed to SearchSecurity that CVE-2021-26084 was now being targeted in the wild.
“I can confirm Bad Packets honeypots have detected mass scanning and exploit activity targeting the Atlassian Confluence RCE vulnerability CVE-2021-26084 from hosts in Russia, Hong Kong, Brazil, Poland and Romania,” Mursch said. “Multiple proof-of-concepts have been published publicly demonstrating how to exploit this vulnerability.”
Administrators are being urged to update any on-premises versions of Atlassian’s Confluence Server collaboration software as hackers have now descended on the critical security flaw. Cloud-hosted versions of Confluence Server are not vulnerable to attack, Atlassian said.
According to Atlassian, the bug normally requires the attacker to be logged into the network to exploit, but under some circumstances, servers can be remotely exploited without any authentication.
I can confirm Bad Packets honeypots have detected mass scanning and exploit activity targeting the Atlassian Confluence RCE vulnerability CVE-2021-26084 from hosts in Russia, Hong Kong, Brazil, Poland and Romania. Troy MurschChief research officer, Bad Packets
In a demonstration of the flaw, researcher Harsh Jaiswal showed how the bug could be exploited to gain remote code execution.
“From our understanding & debugging we came to this conclusion: Attributes of #tag components within Velocity template are evaluated as OGNL Expressions to convert the template into HTML,” Jaiswal wrote.
For administrators, this means that getting the flaw patched as soon as possible is imperative. In some cases, Mursch said, it may already be too late. While Bad Packets doesn’t have an estimate on the number of vulnerable servers in the wild, the sheer volume of activity against the flaw should make the update a priority.
“Organizations using the on-premises version of Confluence need to immediately apply the update provided by Atlassian and check their servers for any indicators of compromise,” said Mursch.
“Given the level of scanning of exploit activity we’ve detected so far today, any unpatched servers are at immediate risk of compromise.”
Cybercrime , Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime Kaspersky Describes ‘Operation TunnelSnake’ That Appears to Have China Connection Prajeet Nair (@prajeetspeaks) • May 12, 2021 Architecture of the Moriya rootkit (Source: Kaspersky) An ongoing advanced persistent threat campaign dubbed “Operation TunnelSnake” has been using a Windows rootkit named Moriya to…
The Biden administration last week expanded a Trump-era list of Chinese companies that Americans can’t invest in because of purported links to the Chinese military and surveillance. Companies on the list include telecom equipment maker Huawei and Chinese oil company China National Offshore Oil Corp. On Tuesday, the Senate passed a bill that aims to…
Events , Governance & Risk Management , Legacy Infrastructure Security BlastWave CEO Tom Sego on Re-Envisioning How We Secure Networks Tom Field (SecurityEditor) • May 21, 2021
Tom Sego, co-founder and CEO, BlastWave Inc.
You can see it in the latest high-profile attacks: Security requirements are ever more…
Breach Notification , Fraud Management & Cybercrime , Incident & Breach Response DarkSide Ransomware Operation Had Claimed Clothing Retailer Was Victim of Its Attack Mathew J. Schwartz (euroinfosec) • July 13, 2021 Guess store in Miami (Photo: Phillip Pessar via Flickr/CC) Clothing retailer Guess suffered a ransomware attack and data breach earlier this…
A new cyber espionage group named Gelsemium has been linked to a supply chain attack targeting the NoxPlayer Android emulator that was disclosed earlier this year. The findings come from a systematic analysis of multiple campaigns undertaken by the APT crew, with evidence of the earliest attack dating back all the way to 2014 under…
The recently patched vulnerabilities in Microsoft Exchange have sparked new interest among cybercriminals, who increased the volume of attacks focusing on this particular vector. While ransomware attacks have increased in frequency in the past six months, cybersecurity company Check Point last week noticed a surge in incidents targeting Microsoft Exchange servers vulnerable to the so-called…
