Associated Vulnerability
Title:Atlassian Confluence Server 注入漏洞 (CVE-2022-26134)Description:In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
Description
CVE-2022-26134 - Pre-Auth Remote Code Execution via OGNL Injection
Readme
# [-] CVE-2022-26134 - Confluence Pre-Auth Remote Code Execution via OGNL Injection
## Usage
```bash
usage: exploit.py [-h] [-f FILE] [-c CMD] [-p LPORT] [-l LHOST] [-u URL] [-o OUTPUT]
options:
-h, --help show this help message and exit
-f FILE, --file FILE example.txt
-c CMD, --cmd CMD Shell command
-p LPORT, --lport LPORT
Local port for reverse shell
-l LHOST, --lhost LHOST
Local host for reverse shell
-u URL, --url URL Base target uri (ex. http://target-uri/)
-o OUTPUT, --output OUTPUT
```
## Shodan Dorks
```bash
shodan search 'http.favicon.hash:-305179312' --fields ip_str,port --limit 500 --separator ":" | sed 's/.$//'
shodan search 'http.component:"atlassian confluence"' --fields ip_str,port --limit 500 --separator ":" | sed 's/.$//'
shodan search 'http.title:"Log In - Confluence" 200' --fields ip_str,port --limit 500 --separator ":" | sed 's/.$//'
shodan search 'http.component:"atlassian confluence" http.title:"Log In - Confluence" 200' --fields ip_str,port --limit 500 --separator ":" | sed 's/.$//'
shodan search 'http.component:"atlassian confluence"' --fields ip_str,port --limit 500 --separator ":" | sed 's/.$//'
shodan search 'http.favicon.hash:-305179312 200' --fields ip_str,port --limit 500 --separator ":" | sed 's/.$//'
```
## Zoomeye Dorks
```bash
zoomeye search 'iconhash:-305179312' -num 800 -filter=ip,port
zoomeye search 'app:"atlassian confluence"' -num 800 -filter=ip,port
zoomeye search 'title:"Log In -Confluence"' -num 800 -filter=ip,port
```
File Snapshot
[4.0K] /data/pocs/58ef64e2c066078c67e3a69681193d55de06a30f
├── [5.5K] exploit.py
├── [ 289] parser_zoomeye.py
├── [1.6K] README.md
├── [ 740] shodan_dork.txt
└── [ 200] zoomeye_dork.txt
0 directories, 5 files
Remarks
1. It is advised to access via the original source first.
2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →