CVE-2021-26084
Published: 30 August 2021
Summary
CVE-2021-26084 is a critical-severity Expression Language Injection (CWE-917) vulnerability in Atlassian Confluence Data Center. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-26084 is an OGNL injection vulnerability affecting Confluence Server and Data Center. The flaw exists in versions before 6.13.23, from 6.14.0 before 7.4.11, from 7.5.0 before 7.11.6, and from 7.12.0 before 7.12.5, and is tracked under CWE-917. It carries a CVSS 3.1 score of 9.8 reflecting network-accessible exploitation with no required credentials or user interaction.
An unauthenticated remote attacker can supply malicious OGNL expressions to the affected instance and achieve arbitrary code execution on the underlying server, resulting in full confidentiality, integrity, and availability impact.
Atlassian’s Jira entry CONFSERVER-67940 and associated security advisory provide patch details and upgrade guidance to the fixed releases listed above. The vulnerability appears in CISA’s catalog of known exploited vulnerabilities, and public exploit code has been published on PacketStorm.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-12905
Vulnerability details
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from…
more
version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks the unauthenticated OGNL expression injection that enables arbitrary code execution by validating all untrusted input before processing.
Requires timely application of the vendor patches that eliminate the OGNL injection flaw in the listed vulnerable Confluence versions.
Detects unauthorized code or configuration changes resulting from successful exploitation of the RCE vulnerability.