in regards to Confluence Security Advisory - 2021-08-25

[Jason Ferris]

Hello,

Quick question. We do do not have this checkbox checked in our Confluence regarding the vulnerability. Does this mean the temporary workaround does not have to be implemented or should it be ran regardless?  We are not able to update Confluence at this time but will in the future here. 

Just checking before I shrug this one off. If I need to implement the temporary workaround regardless, I can do that. 

Thank you!

[Malcolm Ninnes · Accepted solution]

Hey there @Jason Ferris 

Atlassian recommends running the workaround script even if 'Allow people to sign up to create their own account' is disabled.  There are several endpoints identified that expose Confluence to CVE-2021-26084, so applying the workaround script will temporarily mitigate against the known vulnerable end points until you can upgrade to a version that fixes this permanently. 

We've reworded the advisory (Confluence Security Advisory CVE-2021-26084 - OGNL injection - 2021-08-25) to remove any ambiguity.  

Hope this helps!

[Kian Stack Mumo Systems]

Thanks for following up @Malcolm Ninnes!

[Jason Ferris]

@Malcolm Ninnes Thank you very much for the confirmation! I will go ahead and implement the workaround. 

[Kian Stack Mumo Systems]

My reading of the vulnerability would be that you do not need to worry if the feature is not enabled, but I would double check that before deciding not to upgrade. Several people have asked the same question on this ticket, so I would add yourself as a watcher to see any response from Atlassian. 

[Jason Ferris]

@Kian Stack Mumo Systems Thank you! Seems like you do have to run workaround even if not checked per Malcolm. 

[Vedant Kulkarni_Trundl]

@Kian Stack Mumo SystemsDoes this vulnerability issue have an impact on Confluence running behind the VPN? Some of the customers have not exposed their Confluence publicly.

[Kian Stack Mumo Systems]

@Vedant Kulkarni_Trundl, 

I would still perform the upgrade. The security vulnerability is less likely to  exploited if your instance is behind a firewall, but it is still a big vulnerability that should be taken care of.