Atlassian Confluence Server and Data Center Vulnerability

Atlassian Confluence is a service that allows users within an organization to share, collaborate, and organize projects with each other. The company has three various hosting options for its services which are Confluence Server, Confluence Data Center, and Confluence Cloud. With an estimated 180,000 customers, some of the more notable customers are Boeing, Northrop Grumman, Raytheon, NASA, Charles Schwabe, Delta, and Visa.

On August 25, 2021, Atlassian published a security advisory regarding its Confluence Server and Confluence Data Center stating that it was subject to Object-Graph Navigation Language (OGNL) injection. [1]  In the advisory, Atlassian denotes that 31 versions of their affected products were vulnerable and urged system administrators to update to the fixed versions. One week after the advisory was issued, on September 1, 2021, Troy Mursch from Bad Packets detected scanning traffic for vulnerable Confluence Servers in an attempt to exploit them. [5] Once news broke about active attempts to exploit the vulnerabilities, U.S. CYBERCOM issued a warning via Twitter that “Mass exploitation of Atlassian Confluence CVE-2021-26084 is ongoing and expected to accelerate. Please patch immediately if you haven’t already — this cannot wait until after the weekend.” [3]

Around the same time, the Jenkins Project confirmed that their Confluence instance was indeed attacked and exploited. Once the threat was detected, Jenkin Project system administrators took the server offline to prevent any further exploitation and to investigate the impact. [4]