CVE-2021-26072

published 2021-04-01

CVE-2021-26072: The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal…

Priority P2 72 medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C L I N A N

ITW EXPLOIT VulnCheck KEV

The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery (SSRF) vulnerability.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
atlassian	confluence_data_center	< 5.8.6	5.8.6
atlassian	confluence_data_center	>= unspecified < 5.8.6	5.8.6
atlassian	confluence_server	< 5.8.6	5.8.6
atlassian	confluence_server	>= unspecified < 5.8.6	5.8.6

Detection & IOCs extracted from sources · hover to see the quote

url /rest/sharelinks/1.0/link?url=https://{{interactsh-url}}/

path /rest/sharelinks/1.0/link

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Atlassian Confluence Server-Side Request Forgery (CVE-2021-26072)"; flow:established,to_server; http.uri; content:"/rest/sharelinks/1.0/link|3f|"; fast_pattern; content:"url|3d|"; pcre:"/^[a-z]+(?:\x3a|\x253[aA])(?:\x2f{2}|(?:\x252[fF]){2})/R"; reference:url,github.com/assetnote/blind-ssrf-chains#confluence; reference:cve,2021-26072; classtype:web-application-attack; sid:2065569; rev:1; metadata:affected_product Atlassian_Confluence, attack_target Server, tls_state TLSDecrypt, created_at 2025_10_30, cve CVE_2021_26072, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_10_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → Exploit sends a GET request to /rest/sharelinks/1.0/link?url= with an attacker-controlled URL to trigger blind SSRF via the WidgetConnector plugin. Confirm exploitation by observing an outbound HTTP interaction (OOB callback) and response body containing 'faviconURL' and 'domain'.
• → Snort/Suricata detection: match HTTP URI containing '/rest/sharelinks/1.0/link?' followed by 'url=' with a protocol-scheme pattern (including URL-encoded variants like %3a and %2f) to catch both plain and double-encoded SSRF payloads.
• → Shodan query to identify exposed Confluence instances potentially vulnerable to this CVE.

• · Exploitation requires the attacker to be authenticated (PR:L) and have network access to the Confluence server. Blind SSRF means no direct response data is returned; out-of-band (OOB) interaction detection (e.g., interactsh) is needed to confirm exploitation. ↗
• · The Snort rule includes a TLSDecrypt metadata tag, indicating it requires TLS inspection/decryption to fire on HTTPS traffic to Confluence.

CVSS provenance

nvd v3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:P/I:N/A:N

vulncheck 4.3 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-918