Atlassian Confluence RCE Flaw Abused in Multiple Cyberattack Campaigns

Opportunistic menace actors have been found actively exploiting a not long ago disclosed critical security flaw in Atlassian Confluence deployments throughout Windows and Linux to deploy web shells that result in the execution of crypto miners on compromised systems.

Tracked as CVE-2021-26084 (CVSS rating: 9.8), the vulnerability worries an OGNL (Item-Graph Navigation Language) injection flaw that could be exploited to accomplish arbitrary code execution on a Confluence Server or Information Centre occasion.

“A distant attacker can exploit this vulnerability by sending a crafted HTTP request containing a destructive parameter to a vulnerable server,” scientists from Pattern Micro observed in a technological produce-up detailing the weak spot. “Prosperous exploitation can result in arbitrary code execution in the security context of the afflicted server.”

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The vulnerability, which resides in the Webwork module of Atlassian Confluence Server and Facts Middle, stems from an insufficient validation of user-supplied enter, resulting in the parser to evaluate rogue commands injected inside of the OGNL expressions.

The in-the-wild attacks occur right after the U.S. Cyber Command warned of mass exploitation tries pursuing the vulnerability’s community disclosure in late August this year.

In 1 such attack observed by Craze Micro, z0Miner, a trojan, and cryptojacker, was observed up to date to leverage the distant code execution (RCE) flaw to distribute future-stage payloads that act as a channel to preserve persistence and deploy cryptocurrency mining software program on the machines. Imperva, in an independent investigation, corroborated the results, uncovering identical intrusion attempts that ended up aimed at jogging the XMRig cryptocurrency miner and other post-exploitation scripts.

Also detected by Imperva, Juniper, and Lacework is exploitation exercise executed by Muhstik, a China-linked botnet identified for its wormlike self-propagating ability to infect Linux servers and IoT gadgets considering the fact that at minimum 2018.

Additionally, Palo Alto Networks’ Unit 42 risk intelligence crew claimed it recognized and prevented attacks that have been orchestrated to add the customer’s password documents as very well as down load malware-laced scripts that downloaded a miner, and even open up an interactive reverse shell on the machine.

“As is typically the circumstance with RCE vulnerabilities, attackers will rush and exploit impacted programs for their personal get,” Imperva scientists stated. “RCE vulnerabilities can simply permit threat actors to exploit affected units for easy financial attain by setting up crypto currency miners and masking their activity, therefore abusing the processing assets of the focus on.”

Discovered this post exciting? Follow THN on Fb, Twitter  and LinkedIn to read through extra exceptional articles we article.