A critical vulnerability in Atlassian’s Confluence Server software is now under active attack.
Disclosed last week by Atlassian, CVE-2021-26084 is a remote code execution bug that is considered a critical security risk by the vendor. The flaw, which was rated a 9.8 on the CVSS scale, is due to an injection bug in the open source Object-Graph Navigation Language (OGNL) discovered and reported by security researcher Benny Jacob through Atlassian’s bug bounty program.
Troy Mursch, chief research officer with threat intelligence vendor Bad Packets, confirmed to SearchSecurity that CVE-2021-26084 was now being targeted in the wild.
“I can confirm Bad Packets honeypots have detected mass scanning and exploit activity targeting the Atlassian Confluence RCE vulnerability CVE-2021-26084 from hosts in Russia, Hong Kong, Brazil, Poland and Romania,” Mursch said. “Multiple proof-of-concepts have been published publicly demonstrating how to exploit this vulnerability.”
Administrators are being urged to update any on-premises versions of Atlassian’s Confluence Server collaboration software as hackers have now descended on the critical security flaw. Cloud-hosted versions of Confluence Server are not vulnerable to attack, Atlassian said.
According to Atlassian, the bug normally requires the attacker to be logged into the network to exploit, but under some circumstances, servers can be remotely exploited without any authentication.
I can confirm Bad Packets honeypots have detected mass scanning and exploit activity targeting the Atlassian Confluence RCE vulnerability CVE-2021-26084 from hosts in Russia, Hong Kong, Brazil, Poland and Romania. Troy MurschChief research officer, Bad Packets
In a demonstration of the flaw, researcher Harsh Jaiswal showed how the bug could be exploited to gain remote code execution.
“From our understanding & debugging we came to this conclusion: Attributes of #tag components within Velocity template are evaluated as OGNL Expressions to convert the template into HTML,” Jaiswal wrote.
For administrators, this means that getting the flaw patched as soon as possible is imperative. In some cases, Mursch said, it may already be too late. While Bad Packets doesn’t have an estimate on the number of vulnerable servers in the wild, the sheer volume of activity against the flaw should make the update a priority.
“Organizations using the on-premises version of Confluence need to immediately apply the update provided by Atlassian and check their servers for any indicators of compromise,” said Mursch.
“Given the level of scanning of exploit activity we’ve detected so far today, any unpatched servers are at immediate risk of compromise.”
SINGAPORE – Prime Minister Lee Hsien Loong and United States Vice-President Kamala Harris hailed the robust and enduring partnership between their two countries at the Istana on Monday (Aug 23) as they announced new areas of cooperation in cyber security, climate, the economy, and combating pandemics. Ms Harris underlined America’s appreciation for Singapore’s longstanding and…
Written by John Hewitt Jones Aug 3, 2021 | FEDSCOOP The Senate Committee on Homeland Security and Governmental Affairs has identified continued major cybersecurity failings across agencies and is calling for the Federal Information Security Modernization Act (FISMA) to be reformed. A new report published Tuesday identifies IT security flaws across almost every major U.S….
One of the more popular solutions used when deploying, scaling, and managing containerized apps in the Cloud, the Kubernetes containers are often threat actors’ targets. This is the main reason that made the NSA and CISA publish a set of recommendations to help organizations strengthen their security. Source The 52-page cybersecurity technical report released by…
Cybersecurity Executive Order 2021: What It Means for Cloud and SaaS Security | IT Security News 14. June 2021 This article has been indexed from The Hacker News In response to malicious actors targeting US federal IT systems and their supply chain, the President released the “Executive Order on Improving the Nation’s Cybersecurity (Executive Order).”Although directed…
A British train company has been criticized for running a cybersecurity test that made employees think they would receive a bonus for working hard during the pandemic. West Midlands Trains sent an email purporting to be from the company’s managing director, Julian Edwards, out to its approximately 2,500 employees. The missive thanked staff for toiling through…
DES MOINES, Iowa (AP) — Those entrusted with securing the nation’s voting systems must remain nonpartisan as a myriad of complex and growing risks continue to threaten U.S. elections, one of the nation’s top cybersecurity officials said Saturday. Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency, said in an interview with The Associated…
