Skip to content

Commit 108e60a

Browse files
authored
Peer review suggestion to swap out fail_with for print_error
If the response to the code execution request isn't a 200, the module should error instead of fail. All versions tested returned 200s, but it's a great point that some Confluence versions might return a different status code but still pop a shell.
1 parent abb02a9 commit 108e60a

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

modules/exploits/multi/http/atlassian_confluence_rce_cve_2024_21683.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -211,7 +211,7 @@ def upload_payload(shell)
211211
fail_with(Failure::Unknown, 'Target did not respond as expected during code execution attempt') unless res_upload
212212

213213
# If the response to the multipart request does not return a 200.
214-
fail_with(Failure::Unknown, 'The application returned a non-200 response during code execution attempt') unless res_upload.code == 200
214+
print_error(Failure::Unknown, 'The application returned a non-200 response during code execution attempt') unless res_upload.code == 200
215215
end
216216

217217
def exploit

0 commit comments

Comments
 (0)