Atlassian Confluence Server and Data Center OGNL Injection Remote Code Execution (RCE) Vulnerability (CVE-2021-26084) Security Advisory

# 1. Stop the Confluence service
sudo systemctl stop confluence

# 2. Backup Confluence Home and Installation directories
tar -czvf confluence_home_backup.tar.gz /var/atlassian/application-data/confluence
tar -czvf confluence_install_backup.tar.gz /opt/atlassian/confluence

# 3. Download and run the installer for a patched version (e.g., 7.12.5)
wget https://www.atlassian.com/software/confluence/downloads/binary/atlassian-confluence-7.12.5-x64.bin
chmod +x atlassian-confluence-7.12.5-x64.bin
sudo ./atlassian-confluence-7.12.5-x64.bin

# Add to your Nginx configuration file (/etc/nginx/conf.d/confluence.conf)
server {
    listen 80;
    server_name confluence.local;

    # Block requests containing suspicious OGNL payloads
    location / {
        if ($request_uri ~* '(?:\x23|\x25\x23|ognl|Runtime|ProcessBuilder)') {
            return 403 'Access Denied: Malicious Request Detected';
        }
        proxy_pass http://127.0.0.1:8090;
    }
}

#!/bin/bash
LOG_DIR='/var/atlassian/application-data/confluence/logs'

echo '[+] Scanning Confluence logs for CVE-2021-26084 exploitation attempts...'

if [ -d '$LOG_DIR' ]; then
    # Search for common OGNL injection indicators in access logs
    grep -rnEi '(\x23|ognl|Runtime|ProcessBuilder|getRuntime|println)' "$LOG_DIR"/conf_access_log*.log
    if [ $? -eq 0 ]; then
        echo '[!] WARNING: Potential OGNL injection attempts detected. Please inspect the logs immediately.'
    else
        echo '[+] No suspicious OGNL patterns found.'
    fi
else
    echo '[-] Confluence log directory not found.'
fi