CVE-2021-26084

CVE-2021-26084: Atlassian Confluence Server/Data Center Unauthenticated OGNL Injection RCE

AI-generated analysis based on the vulnerability data on this page.

Summary

In affected versions of Confluence Server and Data Center, an unauthenticated attacker can inject and evaluate OGNL (Object-Graph Navigation Language) expressions through a vulnerable endpoint, leading to arbitrary code execution on the host instance. This vulnerability is rated Critical (CVSSv3 9.8), has been exploited in the wild since late 2021, and is tracked in the CISA KEV catalog.

Background

Confluence is a widely deployed enterprise wiki and collaboration platform. Prior to this disclosure, its server-side view-layer templates used OGNL for data binding and expression evaluation. When user input is passed directly into an OGNL evaluation context without proper sanitization, the expression engine can escape its intended scope and execute arbitrary Java code on the underlying server.

Root Cause — CWE-917: Expression Injection

The root cause is an OGNL injection flaw (CWE-917). A server-side code path accepted attacker-controlled input and passed it into an OGNL expression evaluation engine without adequate validation or sandboxing. Because OGNL is a full-featured expression language that can access the Java classloader, object instantiation, and method invocation, an attacker can craft expressions that:

• Load arbitrary classes via the classloader
• Instantiate objects and invoke methods
• Execute operating-system commands through the underlying Java runtime

The vulnerability is unauthenticated, meaning no prior account or session is required to reach the affected endpoint and trigger the injection.

Impact

Bottom line: An unauthenticated attacker can achieve complete host compromise on internet-facing Confluence instances, enabling data theft, lateral movement, ransomware deployment, and persistent backdoors.

Exploitation Walkthrough (Defensive Perspective)

Ethics caveat: The following is a high-level defensive description of how exploitation occurs. No weaponized exploit code is provided.

1. Reconnaissance — The attacker identifies an internet-facing Confluence instance by scanning for the /rest/ or /pages/ URL patterns.

2. Injection Point Discovery — The attacker sends a benign HTTP request containing an OGNL meta-character sequence (e.g., ${...} or ${@...}) to a known endpoint. If the application responds with unusual behavior (e.g., delayed response, Java stack-trace fragments, or unexpected data output), the endpoint is likely evaluating the input as OGNL.

3. Expression Evaluation — The attacker submits an OGNL payload that leverages the static-method access feature (@class@method(...)) to load a Java class capable of running operating-system commands. Because the expression engine runs with the privileges of the Confluence server process, the command executes in the host environment.

4. Post-Exploitation — Once code execution is achieved, the attacker typically:

   • Drops a webshell or remote-access payload for persistence
   • Exfiltrates the Confluence database, which often contains credentials, API keys, and proprietary documents
   • Uses the compromised host as a foothold for lateral movement within the internal network

Defensive takeaway: The low attack complexity and lack of authentication requirements make this vulnerability trivial to exploit with widely available public tools. Patching and network segmentation are therefore critical.

Affected and Patched Versions

Versions not listed above (e.g., 7.13.x and later) are not affected by this specific CVE. Always verify the exact version via the Confluence About page or the /rest/api/serverInfo endpoint.

Remediation

1. Upgrade immediately — Apply the patched version that matches your release track. Atlassian released urgent fixes for all supported LTS branches.
2. Workaround (if patching is delayed) — Atlassian published a temporary mitigation script that blocks the known attack patterns at the web-server or application level. Use this only as a stop-gap measure; it is not a substitute for patching.
3. Compensating controls — Until patched:
   • Restrict Confluence ingress to VPN or corporate IP allow-lists
   • Deploy a Web Application Firewall (WAF) rule set that blocks OGNL meta-characters and known exploit patterns (note: WAF rules can be bypassed)
   • Disable the instance if it is non-critical and internet-facing

Detection

• Network signatures — Monitor HTTP POST/GET requests to Confluence endpoints containing OGNL-specific patterns (${, @java.lang, Runtime, etc.).
• Host indicators — Unexpected child processes spawned by the Confluence Java process (e.g., bash, cmd.exe, powershell, curl, wget).
• File indicators — New webshells under <confluence-home>/ or the webapp directory, or unexpected JSP/Velocity template modifications.
• Log review — Unusual HTTP 200 or 500 responses to /rest/ or /pages/ endpoints from untrusted source IPs.
• Threat-intelligence feeds — Queries to the CISA KEV catalog confirm active exploitation. Correlate Confluence server logs with known exploit-tool user-agent strings.

Assessment

EPSS context: With an EPSS of 0.99999 and a percentile of 0.99993, this vulnerability is statistically among the most likely to be exploited in the wild. The KEV entry and EU exploited status confirm that active exploitation has been observed for years.

Key lessons:

1. Expression languages are dangerous inputs. OGNL, SpEL, and similar engines should never evaluate untrusted data without strict whitelisting or sandboxing. Treat them as potential RCE surfaces.
2. Internet-facing collaboration tools are high-value targets. Confluence, Jira, and similar platforms hold sensitive intellectual property and often have broad network trust relationships. Patching windows for these systems should be measured in hours, not weeks.

References

• https://jira.atlassian.com/browse/CONFSERVER-67940
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26084
• http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html