「💥」CVE-2022-26134

Descripción

En las versiones afectadas de Confluence Server y Data Center, existe una vulnerabilidad de inyección OGNL que permitiría a un atacante no autenticado ejecutar código arbitrario en una instancia de Confluence Server o Data Center. Las versiones afectadas son desde 1.3.0 anteriores a 7.4.17, desde 7.13.0 anteriores a 7.13.7, desde 7.14.0 anteriores a 7.14.3, desde 7.15.0 anteriores a 7.15.2, desde 7.16.0 anteriores a 7.16.4, desde 7.17.0 anteriores a 7.17.4, y desde 7.18.0 anteriores a 7.18.1.

Demo

Uso

pip install requests
git clone https://github.com/AmoloHT/CVE-2022-26134
cd CVE-2022-26134
python3 cve-2022-26134.py -cmd 'id' -u http://TARGET.TLD

Referencias

• URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26134
• MISC:http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html
• URL:http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html
• MISC:http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html
• URL:http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html
• MISC:http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html
• URL:http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html
• MISC:http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
• URL:http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
• MISC:https://jira.atlassian.com/browse/CONFSERVER-79016
• URL:https://jira.atlassian.com/browse/CONFSERVER-79016