SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.
SERVER-WEBAPP Atlassian Confluence OGNL injection remote code execution attempt
This rule detects an attempted remote code execution attempt using OGNL injection against vulnerable versions of Atlassian Confluence by looking for the Unicode escape sequence of a single quote being sent to a vulnerable URI.
This rule detects an attempted remote code execution attempt using OGNL injection against vulnerable versions of Atlassian Confluence.
No public information
No known false positives
Cisco Talos Intelligence Group
Tactic: Initial Access
Technique: Exploit Public-Facing Application
For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org
Command Injection
Command Injection attacks target applications that allow unsafe user-supplied input. Attackers transmit this input via forms, cookies, HTTP headers, etc. and exploit the applications permissions to execute system commands without injecting code.
©2022 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
