Confluence Data Center & Server Flaw Allows Remote Code Execution

Atlassian disclosed a excessive-severity vulnerability that exists in more than one versions of their Confluence Files Heart and Server.

The CVE for this vulnerability develop into as soon as assigned with CVE-2024-21683 and the severity develop into as soon as given as 8.3 (Excessive).

Confluence has addressed this vulnerability within the newest versions of Confluence Files Heart and Server and released major patches. On the other hand, researchers hang realized a plot to exhaust this vulnerability.

Technical Analysis – CVE-2024-21683

Based fully totally on the advisory, this vulnerability develop into as soon as associated with Remote code execution on Confluence Files Heart, which permits an authenticated threat actor with a definite stage of privileges to end arbitrary commands on the affected gadgets.

To successfully exploit this vulnerability, a threat actor requires network acquire admission to to the inclined machine and the privilege to be able to add new macro language as a prerequisite.

This “Add a brand new language” impartial of the “Configure Code Macro” allotment permits users to be able to add a brand new code block macro language to customise the formatting and syntax highlighting.

On the other hand, an authenticated attacker can add a malicious Javascript file to this efficiency, which is in a position to inject malicious Java code on the affected gadgets.

This exploitation can also simply also be finished by crafting a malicious JS file with a code to inject reminiscent of java.lang.Runtime.getRuntime().exec(”contact /tmp/poc”) which is in a position to be completed when uploaded to the server. This execution happens attributable to insufficient validation of the file.

This malicious java code is dispensed for evaluate to the “parseLanguage” plot of “RhinoLanguageParser” class which exists within the WEB-INF/atlassian-bundled-plugins/com.atlassian.confluence.ext.newcode-macro-plugin-5.0.1.jar!/com/atlassian/confluence/ext/code/languages/impl/RhinoLanguageParser.class location.

Additional, the “script” variable is fashioned and the “evaluateString” plot will route of the malicious java code. This “evaluateString” plot will then pass the code to the “doTopCall” plot of “ScriptRuntime” class.

The “doTopCall” plot will end this malicious java code that will lead to arbitrary code execution on the inclined.

On the other hand, this vulnerability has been patched on the newest versions of Confluence Files Heart and Server.

Affected Merchandise And Mounted In Variations

It’s miles advisable that Confluence users upgrade to the newest versions to forestall threat actors from exploiting this vulnerability.

Looking for Full Data Breach Protection? Try Cynet's All-in-One Cybersecurity Platform for MSPs: Try Free Demo