• After successful installation, we will see the interface:

2. Finding the Vulnerability Location and Debugging

2.1 Finding the Vulnerability Location

• According to the POC, the vulnerable function is in the Widget Connector (used to embed videos, external content like YouTube, Vimeo...).
• Let's locate that function:

1. Click on Other macros

2. Search for the Widget Connector macro

3. Enter the link and fill in the required information, then click Preview

2.2 Setting up Debugging

• Since the description mentions Widget Connector, let's try searching in the Confluence source folder

• Read the .jar file using Intellij IDEA
• Set Breakpoints at positions where link resolution is handled and start the debugging process

Proceeding with Debugging

• Start Debugging and set a breakpoint at com.atlassian.confluence.extra.widgetconnector.WidgetMacro.class
• Here we can see various parameters
• It calls the DefaultRenderManager.class

• Here it uses the getEmbeddedHtml() method
• Returns HTML code to embed external content (video, widget, documents, etc.) based on a URL that the user inserts into a Confluence page
• From there, it calls the YoutubeRenderer

• Go into the YoutubeRenderer class
• In this method getEmbeddedHtml(String url, Map<String, String> params)
• url → the original YouTube link entered by the user
• params → a map containing configuration parameters for rendering (e.g., width, height, template used for rendering, etc.).

• Next, it calls getEmbedUrl(), setDefaultParam(), and DefaultVelocityRenderService.render()
• Focus on setDefaultParam()

• If _template is not present → assign the default template youtube.vm. => We can manually add _template to the program.

• Next, go into DefaultVelocityRenderService.render()

1. Purpose of the method

   • Receives url and parameters params.

   • Uses Velocity template (.vm) to render into embedded HTML (iframe, embed, etc.).

2. Template Determination

   • If params has _template → use that template.

   • Otherwise → use default embed.vm.

3. Create default context using MacroUtils.defaultVelocityContext().

• Put all parameters from params into the context:

  • If key = tweetHtml → keep HTML unchanged.

  • Otherwise → safely encode using GeneralUtil.htmlEncode().

• Add urlHtml, width, height to the context (if empty, default to 400 × 300).

• Calls VelocityUtils.getRenderedTemplate()

• Now we will move to the VelocityUtils class
• Above, it calls getRenderedTemplate and getRenderedTemplateWithoutSwallowingErrors()

• Then it calls getTemplate()

• Here, templateName is the _template from above.

• Then it calls VelocityEngine.Template()

• Inside the VelocityEngine class, it calls RunimeInstance.getTemplate()

RuntimeInstance (Velocity core)
This is the "heart" of the Velocity Engine. It handles:

• Engine initialization (init)

• Managing configuration, macros, parser, directives, event handlers…

• And especially: managing resources via ResourceManager

→ This means RuntimeInstance does not load resources itself, but delegates to resourceManager.

• Then it calls CompatibleVelocityResourceManager.getResource()

ConfigurableResourceManager (Confluence custom)
This is an implementation of the ResourceManager interface.
It is responsible for:

• Managing resource loaders (file loader, classpath loader, URL loader…).

• Managing globalCache (caches templates by resourceKey).

• Loading/refreshing template (.vm file) when requested by RuntimeInstance.

• When a resource is in the cache, it does not return immediately, but calls refreshResource(...).

• refreshResource compares the lastModified time on disk with that in the cache.

• If the file has changed → the resource in the cache is invalidated → reload from disk → update cache.

👉 Therefore, you do not need to manually change resourceKey. The refresh mechanism ensures that when the template changes, the cache is also updated.

Add _template and resend the request

• We see the list of ResourceLoader instances (initialized objects) in Velocity

• Here we are only interested in FileResourceLoader and ClasspathResourceLoader

1. For FileResourceLoader

It calls StringUtils.normalizePath() to block path traversal

• The content of normalizePath is as shown

• Try reading the /WEB-INF/web.xml file and you can see that the file was loaded successfully.

• But it still cannot escape the Confluence directory because /../ is blocked.
• Continue checking ClasspathResourceLoader

2. ClasspathResourceLoader

• Follow to ClassUtils.getResourceAsStream

• It calls findResource() of /org/apache/catalina/loader/WebappClassLoaderBase.class

• It then calls super.findResource() which returns a URL, meaning the object can be retrieved.

• Calls url.openStream() to retrieve data

• Finally, the data is fed into the Velocity rendering.

• In real cases where the specific path is unknown, we can leverage Java's file scheme to list directories

Outbound

Executed Payload

• Calls $runtime.exec("id") → runs the OS command "id" on Ubuntu.
• Start an FTP service with the command:

Execute: