How Cloudflare helped mitigate the Atlassian Confluence OGNL vulnerability before the PoC was released

This post details Cloudflare's proactive mitigation of the Atlassian Confluence OGNL injection vulnerability (CVE-2021-26084) before a public Proof of Concept was released. It highlights the immediate review of the vulnerability, the preparation and emergency release of a WAF rule (IDs `100400` and `e8c550810618437c953cf3a969e0b97a`), and the protection offered to customers using Cloudflare WAF and Access. The post analyzes traffic patterns, showing that malicious scanning began days before the PoC, and details the types of attacks observed (command injection, request port anomalies, fake bot signatures, OWASP ModSecurity Core Ruleset triggers, and HTTP request anomalies) before the specific rule was deployed. It emphasizes the effectiveness of a layered security approach.