CVE-2022-26134 PoC — Atlassian Confluence Server 注入漏洞

Source

https://github.com/reubensammut/cve-2022-26134

Associated Vulnerability

Title: Atlassian Confluence Server 注入漏洞 (CVE-2022-26134)
Description:In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

Description

Implementation of CVE-2022-26134

Readme

# CVE-2022-26134
Implementation of CVE-2022-26134

This repository contains my implementation of the exploit for CVE-2022-26134. The version implemented here
bypasses the `isSafeExpression` checks in versions such as 7.18.0. 

The exploit can be run in two modes:

The first mode allows you to run one command at a time:

```bash
python3 cve-2022-26134.py <host> <command>
```

This would return the output of the command if it succeeds or display an empty line if not

The second mode to run this command is interactive mode:

```bash
python3 cve-2022-26134.py <host> -i
```

This launches a non persistent interactive shell, where you can type commands, which get executed on the 
server and then display the results. No state is held between commands. 

![](assets/cve-2022-26134.gif)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →