Sigma rule: Potential CVE-2021-26084 Exploitation Attempt

Rule

Title

Potential CVE-2021-26084 Exploitation Attempt

Status

test

Level

high

Author

Sittikorn S, Nuttakorn T

Date

2022-12-13

Modified

2023-03-24

File

rules-emerging-threats/2021/Exploits/CVE-2021-26084/web_cve_2021_26084_confluence_rce_exploit.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential exploitation of CVE-2021-260841 a Confluence RCE using OGNL injection

Log source

category

webserver

definition

Requirements: The POST request body data must be collected in order to make use of certain parts of this detection

Detection

selection_main:
    cs-method: 'POST'
    sc-status: 200
    cs-username: 'anonymous' # This string is used to reduce possible FP you could remove it to get authenticated attempts
selection_exploit_1:
    cs-uri-query|contains|all:
        - '/pages/createpage-entervariables.action'
        - 'SpaceKey=x' # This URI assume that you can't have a space ID of "X"
selection_exploit_2_uri:
    cs-uri-query|contains: '/doenterpagevariables.action'
selection_exploit_2_keyword:
    - 'u0027' # This string should appear in the post body as a value of the parameter "queryString"
condition: selection_main and (selection_exploit_1 or all of selection_exploit_2_*)

False positives (as the rule lists them)

• Unknown

Tags

• attack.initial-access
• attack.t1190
• cve.2021-26084
• detection.emerging-threats

CVEs this rule names

• CVE-2021-26084

MITRE ATT&CK ids this rule names

• T1190

References

• https://github.com/TesterCC/exp_poc_library/blob/be61622600ec79d8fba2fa5f816a870715f0cb3b/exp_poc/CVE-2021-26084_Confluence_OGNL_injection/CVE-2021-26084.md
• https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md
• https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
• https://mraddon.blog/2017/03/20/confluence-trick-to-create-pages-from-blueprint-templates/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2021/Exploits/CVE-2021-26084/web_cve_2021_26084_confluence_rce_exploit.yml