Skip To Main Content
.getBytes .getClass on Muck Rack

.getBytes .getClass

As seen in: CSDN
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work. Claim your profile
Back to .getBytes .getClass’s profile

Articles by .getBytes .getClass

CVE-2022-26134 Confluence 无文件落地的内存马注入姿势

|
By Illegal AccessException, NoSuchMethod Exception, Invocation TargetException, .getBytes .getClass
| CSDN
一、漏洞信息 最近 Confluence 官方通报了一个严重漏洞 CVE-2022-26134 ，从漏洞描述来看，这是一个 OGNL 表达式注入漏洞。影响版本如下： from 1.3.0 before 7.4.17 from 7.13.0 before 7.13.7 from 7.14.0 before 7.14.3 from 7.15.0 before 7.15.2 from 7.16.0 before 7.16.4 from 7.17.0 before 7.17.4, from 7.18.0 before 7.18.1 漏洞出现在xwork-1.0.3-atlassian-10.jar内，ActionChainResult#execute里提取 namespace 参数，并调用 translateVariables 函数，触发 OGNL 表达式注入。 二、沙箱绕过与命令执行 网上现在已经公开的一些简单粗暴的利用方式，只能在 v7.14 及以下系列有效，从 v7.15 版本开始，Confluence 在 OGNL 表达式解析时加入了安全检查，即在...
Open in Who Shared Issue with article?
Show More