Potential CVE-2021-26084 Confluence OGNL RCE Exploitation Attempt via POST
Flags successful POST requests consistent with OGNL injection attempts targeting Confluence page variable endpoints tied to CVE-2021-26084.
- Category
- webserver
- Author
- Sittikorn S, Nuttakorn T (SigmaHQ), DRL 1.1
- Published
- 2022-12-13
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags successful HTTP POST activity targeting Confluence page creation endpoints, combining specific query parameters and URL-encoded OGNL-related content. Such requests may indicate an attempt to trigger a Confluence remote code execution path. It relies on webserver telemetry including request method, response status, the requested URI query string, and the presence of a specific encoded keyword in the POST body.
Reporting behind it
- github.comhttps://github.com/TesterCC/exp_poc_library/blob/be61622600ec79d8fba2fa5f816a870715f0cb3b/exp_poc/CVE-2021-26084_Confluence_OGNL_injection/CVE-2021-26084.md
- github.comhttps://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md
- confluence.atlassian.comhttps://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
- mraddon.bloghttps://mraddon.blog/2017/03/20/confluence-trick-to-create-pages-from-blueprint-templates/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-26084/web_cve_2021_26084_confluence_rce_exploit.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Potential CVE-2021-26084 Confluence OGNL RCE Exploitation Attempt via POST
id: 1677a696-7b00-4518-a243-490ec66193dc
status: test
description: This rule flags successful HTTP POST activity targeting Confluence page creation endpoints, combining specific query parameters and URL-encoded OGNL-related content. Such requests may indicate an attempt to trigger a Confluence remote code execution path. It relies on webserver telemetry including request method, response status, the requested URI query string, and the presence of a specific encoded keyword in the POST body.
references:
- https://github.com/TesterCC/exp_poc_library/blob/be61622600ec79d8fba2fa5f816a870715f0cb3b/exp_poc/CVE-2021-26084_Confluence_OGNL_injection/CVE-2021-26084.md
- https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md
- https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
- https://mraddon.blog/2017/03/20/confluence-trick-to-create-pages-from-blueprint-templates/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-26084/web_cve_2021_26084_confluence_rce_exploit.yml
author: Sittikorn S, Nuttakorn T, Huntrule Team
date: 2022-12-13
modified: 2023-03-24
tags:
- attack.initial-access
- attack.t1190
- cve.2021-26084
- detection.emerging-threats
logsource:
category: webserver
definition: "Requirements: The POST request body data must be collected in order to make use of certain parts of this detection"
detection:
selection_main:
cs-method: POST
sc-status: 200
cs-username: anonymous
selection_exploit_1:
cs-uri-query|contains|all:
- /pages/createpage-entervariables.action
- SpaceKey=x
selection_exploit_2_uri:
cs-uri-query|contains: /doenterpagevariables.action
selection_exploit_2_keyword:
- u0027
condition: selection_main and (selection_exploit_1 or all of selection_exploit_2_*)
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 38825179-3c78-4fed-b222-2e2166b926b1
type: derived