CVE-2021-26084

Confluence Remote Code Execution RCE

Code By:Jun_sheng @ Orange Cybersecurity Laboratory

Orange Cybersecurity Laboratory https://0range.team/

0x00 Risk Overview

This tool is only for authorized security testing. Unauthorized illegal attacks on sites are prohibited.

Read online Cybersecurity Law of the People's Republic of China

0x01 Tool Usage

For batch RCE script, please import URLs into url.txt

For single site RCE, use the following command:

python confluence_rce.py -u url -c cmd or python confluence_rce.py --url url --command cmd

To use the shell feature, add the --shell parameter

0x02 Bug Issues

Please submit Bugs as Issues. I will check them when I have time.

0x03 Known Bugs Found

1. The batch script execution returns incorrect output. No fix found yet.
2. Fixed an issue with list index out of bounds that occasionally occurred when retrieving command output.

0x04 Content Update

1. Added simulated shell functionality, allowing execution of commands other than preset detection commands while discovering website vulnerabilities.