「💥」CVE-2022-26134

描述

受影响的 Confluence Server 和 Data Center 版本中存在一个 OGNL 注入漏洞，允许未经身份验证的攻击者在 Confluence Server 或 Data Center 实例上执行任意代码。受影响的版本范围：1.3.0 至 7.4.17 之前、7.13.0 至 7.13.7 之前、7.14.0 至 7.14.3 之前、7.15.0 至 7.15.2 之前、7.16.0 至 7.16.4 之前、7.17.0 至 7.17.4 之前、以及 7.18.0 至 7.18.1 之前。

演示

使用方法

pip install requests
git clone https://github.com/AmoloHT/CVE-2022-26134
cd CVE-2022-26134
python3 cve-2022-26134.py -cmd 'id' -u http://TARGET.TLD

参考

• URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26134
• MISC:http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html
• URL:http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html
• MISC:http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html
• URL:http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html
• MISC:http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html
• URL:http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html
• MISC:http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
• URL:http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
• MISC:https://jira.atlassian.com/browse/CONFSERVER-79016
• URL:https://jira.atlassian.com/browse/CONFSERVER-79016