Atlassian Confluence - Remote Code Execution (CVE-2021-26084)

Atlassian Confluence is affected by a Remote Code Execution, located on the createpage-entervariables.action endpoint. Versions lower than 7.12.5 are vulnerable to this OGNL Injection vulnerability. This allows a malicious user to execute arbitrary code on the server.

The risk exists that a remote unauthenticated attacker can fully compromise the Confluence Server in order to steal confidential information, install ransomware or pivot to the internal network.

Sniper can gain unauthenticated Remote Code Execution on the target system and extract multiple artefacts as evidence.

Upgrade the Confluence server to a version higher than 7.12.5.

https://nvd.nist.gov/vuln/detail/CVE-2021-26084

https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html