Security Affairs
Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback|Australian Police Charge Two Over TeamPCP Credential Theft|Meta to Pay Up to $18B Over Teen Social Media Use|CISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers Do|OpenAI banned Russian ChatGPT accounts backing covert influence operation|CISA Red Team Fully Compromised Two Critical Infrastructure Orgs|FBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical Infrastructure|U.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog|88 ID Verification Breaches Show the Cost of Collecting Identity Data|WhatsApp Adds Stronger Security as Passkeys Hit 1 Billion|Operation Jackal: 58 Arrests Expose the Money Laundering Machine Behind Global Scams|Norway ’s Digital Government Infrastructure Hit by a new DDoS Attack|Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback|Australian Police Charge Two Over TeamPCP Credential Theft|Meta to Pay Up to $18B Over Teen Social Media Use|CISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers Do|OpenAI banned Russian ChatGPT accounts backing covert influence operation|CISA Red Team Fully Compromised Two Critical Infrastructure Orgs|FBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical Infrastructure|U.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog|88 ID Verification Breaches Show the Cost of Collecting Identity Data|WhatsApp Adds Stronger Security as Passkeys Hit 1 Billion|Operation Jackal: 58 Arrests Expose the Money Laundering Machine Behind Global Scams|Norway ’s Digital Government Infrastructure Hit by a new DDoS Attack|
Advertisement

Ad Placeholder

Full Width × 90

Breaking News

Attackers are attempting to exploit recently patched Atlassian Confluence CVE-2021-26084 RCE

Threat actors are actively exploiting a recently patched vulnerability in Atlassian’s Confluence enterprise collaboration product. Threat actors were spotted exploiting the CVE-2021-26084 vulnerability in Atlassian’s Confluence enterprise collaboration product a few days after it was patched by the vendor. Last week, Atlassian released security patches to address the critical CVE-2021-26084 flaw that affects the Confluence enterprise […]

Atlassian Confluence CVE-2023-22515

Threat actors are actively exploiting a recently patched vulnerability in Atlassian’s Confluence enterprise collaboration product.

Threat actors were spotted exploiting the CVE-2021-26084 vulnerability in Atlassian’s Confluence enterprise collaboration product a few days after it was patched by the vendor.

Last week, Atlassian released security patches to address the critical CVE-2021-26084 flaw that affects the Confluence enterprise collaboration product.

Atlassian Confidence

The flaw is an OGNL injection issue that can be exploited by an authenticated attacker to execute arbitrary code on affected Confluence Server and Data Center instances.

“An OGNL injection vulnerability exists that would allow an authenticated user, and in some instances unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance. ” reads the advisory published by the company.

The issue was discovered by Benny Jacob (SnowyOwl) through the Atlassian public bug bounty program, the vulnerability received a CVSS score of 9.8.

Affected versions are:

  • version < 6.13.23
  • 6.14.0 ≤ version < 7.4.11
  • 7.5.0 ≤ version < 7.11.5
  • 7.12.0 ≤ version < 7.12.5

Researchers from Threat intelligence firm Bad Packets detected mass scanning and exploit activity targeting Atlassian Confluence servers vulnerable to the above RCE.

Internet scans for systems affected by the CVE-2021-26084 flaw were also spotted by other researchers, the Japan CERT issued a security alert regarding this flaw. https://jpcert.or.jp/english/at/2021/at210037.html

“On September 2, 2021 (Japan time), JPCERT/CC confirmed that an article explaining the details of this vulnerability and Proof-of-Concept code that seems to exploit the vulnerability are made public. The users of the affected products are recommended to take measures such as upgrading to the latest version or apply workaround as soon as possible.” reads the alert from the Japan CERT.

Australian ACSC also issued an alert for CVE-2021-26084 due to ongoing exploitation attempts in the wild.

Technical details and POC for Confluence RCE (CVE-2021-26084) are available here:

Experts believe that the number of attacks targeting this Confluence vulnerability will increase in the next weeks.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″][adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, FIN8)

[adrotate banner=”5″]

[adrotate banner=”13″]

Tags

AtlassianConfluenceHackinghacking newsinformation security newsIT Information SecurityPierluigi PaganiniSecurity AffairsSecurity News

More Stories>

Dark Caracal Deploys New Go Malware With Ethereum-Based C2 FallbackAPT

Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback

Australian Police Charge Two Over TeamPCP Credential TheftBreaking News

Australian Police Charge Two Over TeamPCP Credential Theft

Meta to Pay Up to $18B Over Teen Social Media UseBreaking News

Meta to Pay Up to $18B Over Teen Social Media Use

Security>

Hacking>

Malware>