Webserver Detects Potential OGNL Injection Exploitation of Confluence CVE-2021-26084 via POST

Flags successful POST requests consistent with OGNL injection attempts targeting Confluence page variable endpoints tied to CVE-2021-26084.

FreeUnreviewedSigmahighv1

webserver-detects-potential-ognl-injection-exploitation-of-confluence-cve-2021-2-38825179

title: Webserver Detects Potential OGNL Injection Exploitation of Confluence CVE-2021-26084 via POST
id: 1677a696-7b00-4518-a243-490ec66193dc
status: test
description: This rule identifies web requests that match a likely Confluence RCE exploitation pattern consistent with OGNL injection attempts. It looks for HTTP POST traffic that returns success (status 200) from an anonymous user and targets specific page-creation related endpoints with required query and body characteristics. The detection relies on webserver request telemetry, including HTTP method, response status, requested URI/query string, username, and the presence of an expected POST body keyword.
references:
  - https://github.com/TesterCC/exp_poc_library/blob/be61622600ec79d8fba2fa5f816a870715f0cb3b/exp_poc/CVE-2021-26084_Confluence_OGNL_injection/CVE-2021-26084.md
  - https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md
  - https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
  - https://mraddon.blog/2017/03/20/confluence-trick-to-create-pages-from-blueprint-templates/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-26084/web_cve_2021_26084_confluence_rce_exploit.yml
author: Sittikorn S, Nuttakorn T, Huntrule Team
date: 2022-12-13
modified: 2023-03-24
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2021-26084
  - detection.emerging-threats
logsource:
  category: webserver
  definition: "Requirements: The POST request body data must be collected in order to make use of certain parts of this detection"
detection:
  selection_main:
    cs-method: POST
    sc-status: 200
    cs-username: anonymous
  selection_exploit_1:
    cs-uri-query|contains|all:
      - /pages/createpage-entervariables.action
      - SpaceKey=x
  selection_exploit_2_uri:
    cs-uri-query|contains: /doenterpagevariables.action
  selection_exploit_2_keyword:
    - u0027
  condition: selection_main and (selection_exploit_1 or all of selection_exploit_2_*)
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 38825179-3c78-4fed-b222-2e2166b926b1
    type: derived

What it detects

This rule identifies web requests that match a likely Confluence RCE exploitation pattern consistent with OGNL injection attempts. It looks for HTTP POST traffic that returns success (status 200) from an anonymous user and targets specific page-creation related endpoints with required query and body characteristics. The detection relies on webserver request telemetry, including HTTP method, response status, requested URI/query string, username, and the presence of an expected POST body keyword.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.