「💥」CVE-2022-26134

설명

영향을 받는 Confluence Server 및 Data Center 버전에서 OGNL 주입 취약점이 존재하며, 이를 통해 인증되지 않은 공격자가 Confluence Server 또는 Data Center 인스턴스에서 임의 코드를 실행할 수 있습니다. 영향을 받는 버전은 1.3.0부터 7.4.17 미만, 7.13.0부터 7.13.7 미만, 7.14.0부터 7.14.3 미만, 7.15.0부터 7.15.2 미만, 7.16.0부터 7.16.4 미만, 7.17.0부터 7.17.4 미만, 7.18.0부터 7.18.1 미만입니다.

데모

사용법

pip install requests
git clone https://github.com/AmoloHT/CVE-2022-26134
cd CVE-2022-26134
python3 cve-2022-26134.py -cmd 'id' -u http://TARGET.TLD

참고자료

• URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26134
• MISC:http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html
• URL:http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html
• MISC:http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html
• URL:http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html
• MISC:http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html
• URL:http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html
• MISC:http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
• URL:http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
• MISC:https://jira.atlassian.com/browse/CONFSERVER-79016
• URL:https://jira.atlassian.com/browse/CONFSERVER-79016