CVE-2021-26085

published 2021-08-03

CVE-2021-26085: Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability…

Priority P1 84 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C L I N A N

KEV ITW EXPLOIT Ransomware

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
atlassian	confluence_data_center	< 7.4.10	7.4.10
atlassian	confluence_data_center	>= 7.5.0 < unspecified	unspecified
atlassian	confluence_data_center	>= 7.5.0 < 7.12.3	7.12.3
atlassian	confluence_data_center	>= unspecified < 7.4.10	7.4.10
atlassian	confluence_data_center	>= unspecified < 7.12.3	7.12.3
atlassian	confluence_server	< 7.4.10	7.4.10
atlassian	confluence_server	>= 7.5.0 < unspecified	unspecified
atlassian	confluence_server	>= 7.5.0 < 7.12.3	7.12.3
atlassian	confluence_server	>= unspecified < 7.4.10	7.4.10
atlassian	confluence_server	>= unspecified < 7.12.3	7.12.3

Detection & IOCs extracted from sources · hover to see the quote

url /s/123cfx/_/;/WEB-INF/web.xml↗

url /s/123cfx/_/;/WEB-INF/classes/seraph-config.xml↗

url /s/123cfx/_/;/META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.properties↗

url /s/123cfx/_/;/META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.xml↗

path /WEB-INF/web.xml

path /META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.xml

path /META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.properties

snort

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Atlassian Confluence Pre-Authorization Arbitrary File Read Attempt (pom.xml) (CVE-2021-26085)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/s/123cfx/_/|3b|/META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.xml"; nocase; fast_pattern; http.header_names; to_lowercase; content:!"cookie|0d 0a|"; content:!"authorization|0d 0a|"; reference:url,packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html; reference:cve,2021-26085; classtype:attempted-admin; sid:2034153; rev:2; metadata:attack_target Server, created_at 2021_10_07, cve CVE_2021_26085, deployment Perimeter, deployment Internal, performance_impact Low, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_25;)

snort

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Atlassian Confluence Pre-Authorization Arbitrary File Read Attempt (web.xml) (CVE-2021-26085)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/s/123cfx/_/|3b|/WEB-INF/web.xml"; nocase; fast_pattern; http.header_names; to_lowercase; content:!"cookie|0d 0a|"; content:!"authorization|0d 0a|"; reference:url,packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html; reference:cve,2021-26085; classtype:attempted-admin; sid:2034150; rev:2; metadata:attack_target Server, created_at 2021_10_07, cve CVE_2021_26085, deployment Perimeter, deployment Internal, performance_impact Low, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_25;)

snort

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Atlassian Confluence Pre-Authorization Arbitrary File Read Attempt (pom.properties) (CVE-2021-26085)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/s/123cfx/_/|3b|/META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.properties"; nocase; fast_pattern; http.header_names; to_lowercase; content:!"cookie|0d 0a|"; content:!"authorization|0d 0a|"; reference:url,packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html; reference:cve,2021-26085; classtype:attempted-admin; sid:2034152; rev:2; metadata:attack_target Server, created_at 2021_10_07, cve CVE_2021_26085, deployment Perimeter, deployment Internal, performance_impact Low, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_25;)

• → Exploit requests use a semicolon (;) path segment bypass pattern in the /s/ endpoint URI to bypass pre-authorization checks. The literal byte |3b| in Snort rules represents the semicolon used in the path traversal. ↗
• → Nuclei template matches on HTTP 200 response body containing both 'Confluence' and 'com.atlassian.confluence.setup.ConfluenceAppConfig' strings to confirm successful exploitation via /WEB-INF/web.xml read.
• → Snort rules filter for absence of Cookie and Authorization headers to identify unauthenticated (pre-authorization) exploit attempts, distinguishing them from legitimate authenticated requests.
• → Shodan/FOFA queries can identify exposed Confluence instances as potential targets.

• · The Snort ET rules (sid:2034150, 2034152, 2034153) match on the specific static path segment '123cfx' used in known PoC exploits. Real-world attackers may use different random strings in that path segment, so broader URI pattern matching on the /_/;/ bypass pattern is recommended. ↗
• · The Nuclei template uses a randomized string ({{randstr}}) in the path rather than the static '123cfx' seen in PoC, reflecting that any string can be used in that segment of the exploit URL.

CVSS provenance

nvd v3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

vulncheck 5.3 MEDIUM

cisa 5.3 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-425 CWE-862