Patch Confluence: exploitation started in days
A Confluence bug patched on 25 August is now under mass attack. Self-hosted servers on the internet are being taken over.
On 25 August Atlassian fixed a critical bug in Confluence Server and Data Center (CVE-2021-26084). Within a week, attackers were mass-scanning for unpatched servers, mostly installing crypto miners so far. US Cyber Command posted a warning on Friday.
The window between patch and attack keeps shrinking. A few days is now normal.
- Update Confluence to a fixed version, or apply Atlassian’s temporary script if you can’t today.
- Check for miners and new processes started by the Confluence user, and new files in its directories.
- If it was exposed and unpatched, check what credentials the server holds and rotate them.
- Put self-hosted tools behind a VPN or an authenticating proxy, so the next bug isn’t open to everyone.
Confluence Cloud isn’t affected.