Name | confluence_macro_lfi |
CVE | CVE-2019-3396 |
Exploit Pack | CANVAS |
Description | Confluence Server and Data Center - LFI (CVE-2019-3396) |
Notes | Repeatability: NOTES: A] Default behavior =================== By default, this module attempts to automatically locate and then fetch the confluence database. This is all possible thanks to the fact that the LFI primitive will turn into a directory listing whenever a directory is specified instead of a file. To perform the attack on the CLI one may type from $CANVAS_ROOT: (takes some time) python2 exploits/remote/universal/confluence_macro_lfi/confluence_macro_lfi.py -t 10.161.0.241 -p 8090 -Ovhost:'10.161.0.241' There are however a couple of limitations: 1. The search algorithm is rather naive and will not be able to handle installation with too specific installation paths. 2. A huge problem with Confluence is the way Java handles the memory when the LFI primitive is used. Because of this, whenever the file included with the LFI primitive is too big (couple of megabytes), the server process may actually crash being unable to allocate enough. This is in particular true with the confluence database which is more than 20 megabytes initially. Note: Linux seems much less stable than Windows in that regard. 3. There is a limitation to how much the server can send. Our tests though show that most of the time, while truncated, the partial DB will include user information (such as potentially user hashes which may later be cracked). B] Targeting arbitrary files ============================ First of all it should be noticed that both absolute paths can be used by the attacker on directories (directory listing) or files (file inclusion) thus depending on the configuration of the confluence service, several things could be attempted: - Kerberos tickets retrieval - Shadow leak (if confluence is running as root) - Any sensitive credentials in general without ACL protection This may or may not lead to RCE. 1. Linux examples ----------------- # Chosen absolute path: python2 exploits/remote/universal/confluence_macro_lfi/confluence_macro_lfi.py -t 10.161.0.239 -p 8090' 2. Windows examples ------------------- # Chosen relative path: python2 exploits/remote/universal/confluence_macro_lfi/confluence_macro_lfi.py -t 10.161.0.241 -p 8090 -Oremote_file:../web.xml #Chosen absolute path: python2 exploits/remote/universal/confluence_macro_lfi/confluence_macro_lfi.py -t 10.161.0.241 -p 8090 -Oremote_file:'C:\windows\win.ini' Tested against: - Confluence 6.6.11 (Ubuntu) - Confluence 6.10.1 (Windows 2008 R2) VENDOR: Atlassian CVE Url: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3396 CVE Name: CVE-2019-3396 |
Learn more about the CANVAS Exploit Pack here: CANVAS |