Threat Spotlight: Remote code execution vulnerabilities

Anyone with access to an endpoint with a vulnerable version of software can execute arbitrary commands over an HTTP request without the need of an authorization header. The expected response to this request would be a 401 “Unauthorized” response page. However, the user can execute commands with root privileges. These threats were previously seen during the Equifax attack back in 2017.

- Marcus Gower

Two recently uncovered vulnerabilities are the latest evolutions of this type of attack: The Atlassian Confluence OGNL injection vulnerability and a vulnerability affecting the AzureOpen Management Infrastructure (OMI). Barracuda researchers analyzed attacks attempting to exploit these vulnerabilities over a 45-day period in August and September and found spikes in attacks coming from more than 500 unique attacker IPs.

HIGHLIGHTED THREAT

Remote Code Execution (RCE) vulnerabilities: RCE is the term to describe the execution of arbitrary code on a computer system, where the threat actor does not have direct access to the console. It is as if the attacker is physically sitting in front of the system as they take full control of it.

THE DETAILS

The Atlassian Confluence OGNL injection vulnerability was first published by Atlassian on August 25, 2021. Shortly after that, it was added to the National Vulnerability Database (CVE-2021-26084). This vulnerability allows threat actors to commit a “POST” request, using the Confluence template engine, without an authorization header. This grants the threat actor “root” access into the system. Using the parameters “queryString” and “linkCreation”, the attackers can inject Java code.

Atlassian has announced that “All versions of Confluence Server and Data Center prior to the fixed versions are affected by this vulnerability.”