roodhelios/cve-2022-26134-ognl-injectionExploit for CVE-2022-26134, an OGNL injection vulnerability in Atlassian Confluence Server and Data Center, enabling unauthenticated remote code execution.
Local Python workflows for turning request-URI evidence into a reproducible analyst case and reviewing claimed Confluence mitigation evidence. The original academic paper and slides are preserved. These tools do not send exploit requests or scan hosts.
Use Python 3.11 or newer. From the repository root, run with the standard library:
python -m detection.demo
The fixture report becomes one case routed to application-security. The command
stores it in temporary SQLite, retries the insert without a duplicate, and verifies
the stored evidence. Temporary files are removed. This establishes local consistency,
not source authenticity, incident confirmation or successful mitigation.
Exercise native SQLite recovery across abrupt local writer process exits:
python -m detection.demo_recovery
Expect case_recovery_exercise_passed: an exit before commit leaves zero cases;
an exit after commit leaves one. Reopening, integrity checks and repeated retries
must end with exactly one verified case in each scenario. Only synthetic temporary
databases are used. See the recovery boundaries
before interpreting this as durability evidence.
Exercise the separate cluster-manifest publication boundary on POSIX:
python -m detection.demo_cluster_recovery
Expect cluster_publication_recovery_exercise_passed. Three child processes exit
before linking the manifest, after linking it, and after syncing its directory.
The parent authenticates the surviving synthetic evidence and checks that a retry
preserves an existing destination. Only aggregate outcomes are printed. See the
publication recovery limits.
Exercise the complete two-file cluster bundle on POSIX:
python -m detection.demo_cluster_bundle_recovery
Expect cluster_bundle_recovery_exercise_passed. Abrupt child exits leave an empty,
cluster-only or complete bundle. Explicit resume verifies matching survivors, preserves
their bytes and inodes, publishes missing files and authenticates the complete pair.
Only temporary synthetic evidence and ephemeral keys are used. The
private bundle workflow
explains the command, required private parent, locks and recovery limits.
On POSIX, install the optional signing dependency and run the whole synthetic path:
python -m pip install -r requirements-signing.txt
python -m detection.demo_handoff
Expect handoff_exercise_passed, two parsed log lines, one emitted finding, and
authenticated_and_reproduced for the valid handoff. Changed handoff bytes, changed
source bytes and a revoked key are rejected. Real Ed25519 verification runs under an
explicitly trusted demo policy and a fixed exercise clock. The recipient verifies
after the original database and private signing key have been deleted.
The exercise now uses policy-selected signing and pins the reviewed policy bytes. It also requires rejection of retired-key signing and an incorrect pin, while allowing retired-key verification within its supplied window. These are local fixture outcomes.
The exercise generates ephemeral keys and discards all temporary files. It prints only aggregate outcomes, not keys, signatures, raw request URIs, case IDs or local paths. It does not contact a service, authenticate a real collector or prove signing time. The handoff walkthrough explains how to retain your own authorized case, select a separately trusted key and reproduce it.
| Goal | Guide |
|---|---|
| Read the original research overview | Case study |
| Read the academic paper | Technical paper |
| View the original slides | Presentation |
| Review the request flow | Analysis notes |
| Parse a saved log and retain a case | Detailed case workflows |
| Inspect node and cluster mitigation claims | Mitigation example |
| Review formats, interfaces and limits | Detection guide |
| Understand legacy package locations | Compatibility notes |
| Area | Implemented boundary | Limit |
|---|---|---|
| URI/log analysis | Bounded local parsing and evidence-linked findings | A match does not prove code execution |
| Case handling | Routing, append-only SQLite, exports and source reproduction | Local consistency does not authenticate source truth |
| Handoff verification | Ed25519 signatures, explicit verification-key policy and retained-log reproduction | Policy trust and review clock are supplied externally |
| Mitigation review | Version/workaround and cluster evidence review | File presence or a signed claim does not prove a deployment fixed |
| Cluster manifests | Shared-HMAC authentication and private publication | HMAC holders can create records; no independent signer identity |
The verification-key policy handles active/retired windows and revoked keys locally. An optional independently supplied policy digest can require an exact reviewed version. It is not an authenticated directory, a fresh revocation service or enforcement on the separate raw-key signing command. See the detailed workflow before using real keys. The policy-selected signer checks an active key, review window, matching private key and retained source before publishing a detached signature. Retired keys can verify but cannot use this signing path.
python -m unittest discover -s tests -v
python -m unittest discover -s CVE-2022-26134-OGNL-Injection/tests -v
Signing tests require the optional dependency; skipped tests do not establish that signature verification ran. Tests use synthetic/local data, not deployed Confluence.
Keep real incident logs, case records and keys private and outside Git. Use only owned or explicitly authorized inputs. No live malware or weaponized automation is part of these workflows. The tools are defensive review aids, not patch certification.