TTP Tuesday: Confluence Server and Apache Spark CVEs
OGNL injection in Confluence Server & Data Center allows unauthenticated remote code execution
This week, we are releasing two CVE TTPs:
Is CVE-2021-26084 patched on Confluence?
Is CVE-2022-33891 patched on this host?
Is CVE-2021-26084 patched on Confluence?
This vulnerability allows unauthenticated arbitrary code execution on Confluence Server & Data Center. It does this by taking advantage of how OGNL, an Expression Language for Java objects, evaluates user-supplied data.
OGNL injection is an example of server-side template injection which is when an attacker exploits a template syntax bug to inject code into the template engine. Template engines are used to generate web pages and other dynamic content via a special template syntax that substitutes values into a parameterized syntax template. A familiar example may be the Jinja templating library in Python or Mustache for JavaScript.
In Confluence Server and Data Center, before 6.13.23, from 6.14.0 before 7.4.11, from 7.5.0 before 7.11.6, and from 7.12.0 before 7.12.5, an OGNL vulnerability exists that allows an unauthenticated user to remotely execute code on the server. The exploit requires sending an HTTP POST request to the Confluence Server containing the template engine exploit. When Confluence handles this POST request the template engine executes the template code and no further user interaction is required.
Testing
Execute Operator’s CVE-2021-26084 TTP on each Confluence Server instance in your environment to test if you are vulnerable.
The TTP is configured to send a POST request to localhost using the default Confluence Server port 8090. Depending on your Confluence configuration, and whether this TTP is being run on the server or remotely, it may be necessary to adjust the URL in the TTP file. When the exploit is successful the HTTP POST response will contain the string CVE-2021-26084 in the message body.
Vulnerability scanners typically test this CVE by relying on the Confluence version, or remote exploitation of the Confluence Server via the specially crafted request.
Remediation
Upgrade Confluence Server & Data Center to the latest version. Atlassian has published a security advisory with instructions for patching.
Is CVE-2022-33891 patched on this host?
Kostya Kortchinsky, a Databricks cybersecurity researcher, reported the recently discovered Apache Spark bug (CVE-2022-33891). This issue allows adversaries to execute arbitrary shell commands as a current Spark user. Due to Spark UI's sparks.acls.enable option, arbitrary command execution occurs when Spark uses a raw Linux command to check the group membership of the user passed in the `?doAs` parameter. The command output is placed in the `id` field in the response.
Testing
Execute Operator’s CVE-2022-33891 TTP on each instance running Apache Spark in your environment to test if you are vulnerable.
The TTP is configured to upload a web shell to the machine, run a command, and check for a specific output. If the output is successful then the TTP will remove the web shell from your filesystem.
Remediation
It is strongly advised to update to Apache Spark 3.1.3, 3.2.2, or 3.3.0 maintenance release to safeguard your instances against potential exploitation attempts.
Check out “Is CVE-2021-26084 patched on Confluence?” on the Prelude Chains website.
Staying up to date
Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!
There are several ways to follow us and learn more about Prelude and our team members:
Get our products
Download Prelude Operator: https://www.prelude.org/download
See the latest kill chain and TTP Releases: https://chains.prelude.org
See our open-source repositories: https://github.com/preludeorg
Join our community
Discord: https://discord.gg/gzUv4XNquu
Reddit: https://www.reddit.com/r/preludeorg/
Twitter: https://twitter.com/preludeorg
Read, watch, and listen
Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: https://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg
Follow our team
David: https://twitter.com/privateducky
Alex: https://twitter.com/khyberspache
Kris: https://twitter.com/Xanthonus
Octavia: https://twitter.com/VV_X_7
Bart: https://twitter.com/bartimusprimed
Sam: https://twitter.com/heavenraiza