CVE-2022-26134 PoC — Atlassian Confluence Server 注入漏洞

Source

https://github.com/r1skkam/TryHackMe-Atlassian-CVE-2022-26134

Associated Vulnerability

Title:Atlassian Confluence Server 注入漏洞 (CVE-2022-26134)
Description:In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

Description

Atlassian, CVE-2022-26134  An interactive lab showcasing the Confluence Server and Data Center un-authenticated RCE vulnerability.

Readme

[TryHackMe | Atlassian, CVE-2022-26134](https://tryhackme.com/room/cve202226134)

# TryHackMe Atlassian CVE-2022-26134
**Atlassian, CVE-2022-26134** `An interactive lab showcasing the Confluence Server and Data Center un-authenticated RCE vulnerability.`

## Task 1 Introduction
[Confluence | Your Remote-Friendly Team Workspace | Atlassian](https://www.atlassian.com/software/confluence)

[NVD - CVE-2022-26134](https://nvd.nist.gov/vuln/detail/CVE-2022-26134)

![image](https://user-images.githubusercontent.com/58542375/177181586-80440a88-1739-46e1-a73e-a067ef5f979c.png)

## Task 2 Deploy the Vulnerable Machine
http://10.10.186.32:8090/
![image](https://user-images.githubusercontent.com/58542375/177192180-081fa480-5d49-4b0a-8058-9cff84237fa6.png)

## Task 3 Explaining the Vulnerability
*OGNL (Object-Graph Navigation Language) expression language for Java*

## Task 4 Exploit Detection and Patching
[Confluence Security Advisory 2022-06-02 | Confluence Data Center and Server 7.18 | Atlassian Documentation](https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html)

[threat-intel/yara.yar at main · volexity/threat-intel](https://github.com/volexity/threat-intel/blob/main/2022/2022-06-02%20Active%20Exploitation%20Of%20Confluence%200-day/indicators/yara.yar)

[TryHackMe | Yara](https://tryhackme.com/room/yara)

## Task 5 Exploitation
[URL Encode and Decode - Online](https://www.urlencoder.org/)

![image](https://user-images.githubusercontent.com/58542375/177192717-838fbc62-5f13-4d5b-9dd0-f6f6fe12ba2d.png)

## Task 6 Conclusion
[TryHackMe | Recent Threats](https://tryhackme.com/module/recent-threats)

![image](https://user-images.githubusercontent.com/58542375/177190449-5661c2ab-c0d8-4cd8-9269-2c4537567fe4.png)

[NVD - CVE-2022-26134](https://nvd.nist.gov/vuln/detail/CVE-2022-26134)

[Hunting for Confluence RCE [CVE-2022–26134] | by th3b3ginn3r | Jun, 2022 | Medium](https://medium.com/@th3b3ginn3r/hunting-for-cve-2022-26134-confluence-rce-on-linux-server-ae9ce0176b4a)

[The Confluence RCE Vulnerability (CVE-2022-26134): Overview, Detection, and Remediation | Datadog](https://www.datadoghq.com/blog/confluence-vulnerability-overview-and-remediation/)

[Nwqda/CVE-2022-26134: Atlassian Confluence (CVE-2022-26134) - Unauthenticated OGNL injection vulnerability (RCE).</title>
](https://github.com/Nwqda/CVE-2022-26134)

[OGNL Injection (OGNL)](https://www.contrastsecurity.com/glossary/ognl-injection-ognl)

File Snapshot


 [4.0K]  /data/pocs/2c0ae5483ae69c2b89e81ee17f72136be1a5f644
└── [2.4K]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!