Attackers are targeting vulnerable Confluence instances after company published a fix for the vulnerability back in March 2019. Background On March 20, Atlassian published a Confluence Security Advisory to announce fixes for two vulnerabilities, CVE-2019-3395 and CVE-2019-3396.

CVE-2019-3396: Vulnerability in Atlassian Confluence Widget Connector Exploited in the Wild

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.6.12, 6.7.x prior to 6.12.3, 6.13.x prior to 6.13.3, or 6.14.x prior to 6.14.2. It is, therefore, affected by the following vulnerabilities :

 - A server-side request forgery (SSRF) exists in the WebDAV plugin due to improper input validation. An attacker can exploit this, via unspecified vectors, to send arbitrary HTTP and WebDAV requests from the application. (CVE-2019-3395)

 - A server-side template injection exists in the Widget Connector due to improper input validation. An attacker can exploit this, via unspecified vectors, to traverse directories or execute arbitrary code. (CVE-2019-3396)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12, 6.7.0 < 6.12.3, 6.13.0 < 6.13.3 and 6.14.0 < 6.14.2 allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

This vulnerability has been verified using a remote check and should be remediated immediately.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.6.12, 6.7.x prior to 6.12.3, 6.13.x prior to 6.13.3, or 6.14.x prior to 6.14.2. It is, therefore, affected by the following vulnerabilities:

 - A server-side request forgery (SSRF) exists in the WebDAV plugin due to improper input validation. An attacker can exploit this, via unspecified vectors, to send arbitrary HTTP and WebDAV requests from the application. (CVE-2019-3395)
 - A server-side template injection exists in the Widget Connector due to improper input validation. An attacker can exploit this, via unspecified vectors, to traverse directories or execute arbitrary code. (CVE-2019-3396)

According to the tests performed by Nessus, the remote host is affected by the following vulnerability:

  - A server-side template injection exists in the Widget     Connector due to improper input validation. An attacker     can exploit this, via unspecified vectors, to traverse     directories or execute arbitrary code. (CVE-2019-3396)

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.6.12, 6.7.x prior to 6.12.3, 6.13.x prior to 6.13.3, or 6.14.x prior to 6.14.2. It is, therefore, affected by the following vulnerabilities :

  - A server-side request forgery (SSRF) exists in the     WebDAV plugin due to improper input validation. An     attacker can exploit this, via unspecified vectors, to     send arbitrary HTTP and WebDAV requests from the     application. (CVE-2019-3395)

  - A server-side template injection exists in the Widget     Connector due to improper input validation. An attacker     can exploit this, via unspecified vectors, to traverse     directories or execute arbitrary code. (CVE-2019-3396)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
98641	Atlassian Confluence < 6.6.12 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98640	Atlassian Confluence 6.7.x < 6.12.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98639	Atlassian Confluence 6.13.x < 6.13.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98638	Atlassian Confluence 6.14.x < 6.14.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98613	Atlassian Confluence < 6.6.12 / 6.7.x < 6.12.3 / 6.13.x < 6.13.3 / 6.14.x < 6.14.2 Template Injection	Web App Scanning	Component Vulnerability	critical
700661	Atlassian Confluence < 6.6.12 / 6.7.x < 6.12.3 / 6.13.x < 6.13.3 / 6.14.x < 6.14.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	critical
124004	Atlassian Confluence < 6.6.12 / 6.7.x < 6.12.3 / 6.13.x < 6.13.3 / 6.14.x < 6.14.2 Template Injection	Nessus	CGI abuses	critical
123008	Atlassian Confluence < 6.6.12 / 6.7.x < 6.12.3 / 6.13.x < 6.13.3 / 6.14.x < 6.14.2 Multiple Vulnerabilities	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2019-3396

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical