The cybersecurity authorities of the U.S. Cyber command have recently been notified regarding the increase in the number of scans and attempts to exploit a newly identified vulnerability in corporate servers along with the Atlassian Confluence wiki engine installed.
CVE-2021-26084 in Confluence Server and Confluence Data Center software is the vulnerability that has been confirmed by security experts. This vulnerability generally enables the threat actors to perform arbitrary code, but the main problem is related to the inaccurate processing of input data.
Not only this but the security researchers also asserted that it can be exploited to bypass authentication and to administer malicious OGNL commands, that will fully compromise a vulnerable system.
The cybersecurity analysts have detected a vulnerability in Atlassian’s Confluence software on August 25th, and soon after detection, they published the vulnerability details.
According to the report, a cybersecurity researcher called SnowyOwl (Benny Jacob) discovered that an unauthenticated user could easily run arbitrary code just by targetting HTML fields that are interpreted and executed by the Object-Graph Navigation Language (OGNL).
The important point is that the analysts have investigated the vulnerability and they found that the internet had above 14,637 exposed and vulnerable Confluence servers.
After detecting the vulnerable servers, they compared it with the September 1st, and there they recognized 14,701 services that self-identified as a Confluence server.
And not only this but apart from the servers, there are, 13,596 ports and 12,876 individual IPv4 hosts that are continuously running an exploitable version of the software.
However, in the CVE-2021-26084, all the vulnerable endpoints can easily be obtained by a non-administrator user or an unauthenticated user only if ‘Allow people to sign up to create their account’ is being permitted.
Not only this but one can easily check whether this option is being allowed or not, by simply going to COG > User Management > User Signup Options.
Apart from this, Atlassian suggests the users upgrade to the latest Long Term Support release, and not only this but users can also download the latest version from the download center.
Here’s the list of all the affected versions:-
Here’s the list of all the versions that are fixed mentioned below:-
In case if the users can not upgrade to Confluence as soon as possible, then as a substitute workaround, users can mitigate the problem by operating the script that we have mentioned below for the Operating System which is being hosted by Confluence.
Confluence Server or Data Center Node running on Linux-based Operating System…
Confluence Server or Data Center Node running on Microsoft Windows…
The report of Atlassian pronounced that Confluence’s customer base comprises nearly 60,000 companies and organizations, which also includes:-
However, as the popularity of Confluence software is increasing at a rapid speed, and that’s why security experts are expecting a rise in the number of attacks using this problem in the coming days.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…