CVE-2019-3398
published 2019-04-18CVE-2019-3398: Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add…
PriorityP195high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
97.15%
99.9th percentile
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | confluence | >= 2.0.0 < unspecified | unspecified |
| atlassian | confluence | >= 6.13.0 < unspecified | unspecified |
| atlassian | confluence | >= 6.14.0 < unspecified | unspecified |
| atlassian | confluence | >= 6.15.0 < unspecified | unspecified |
| atlassian | confluence | >= 6.7.0 < unspecified | unspecified |
| atlassian | confluence | >= unspecified < 6.6.13 | 6.6.13 |
| atlassian | confluence | >= unspecified < 6.12.4 | 6.12.4 |
| atlassian | confluence | >= unspecified < 6.13.4 | 6.13.4 |
| atlassian | confluence | >= unspecified < 6.14.3 | 6.14.3 |
| atlassian | confluence | >= unspecified < 6.15.2 | 6.15.2 |
| atlassian | confluence_server | >= 2.0 < 6.6.13 | 6.6.13 |
| atlassian | confluence_server | >= 6.13.0 < 6.13.4 | 6.13.4 |
| atlassian | confluence_server | >= 6.14.0 < 6.14.3 | 6.14.3 |
| atlassian | confluence_server | >= 6.15.0 < 6.15.2 | 6.15.2 |
| atlassian | confluence_server | >= 6.7.0 < 6.12.4 | 6.12.4 |
Detection & IOCsextracted from sources · hover to see the quote
path../../../../../../opt/atlassian/confluence/confluence/pages/<randstr>.jsp
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] 8090 (msg:"ET EXPLOIT Confluence Server Path Traversal Vulnerability (CVE-2019-3398)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"plugins/drag-and-drop/upload.action"; nocase; fast_pattern; content:"draftId="; nocase; distance:0; content:"filename="; nocase; content:"/shell.jsp"; nocase; content:"atl_token"; nocase; http.request_body; content:"<%"; reference:url,github.com/superevr/cve-2019-3398/blob/master/poc.py; reference:cve,2019-3398; classtype:attempted-admin; sid:2034261; rev:1; metadata:created_at 2021_10_27, cve CVE_2019_3398, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_10_27, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery; target:dest_ip;)
- →Detect exploit attempts by monitoring POST requests to /plugins/drag-and-drop/upload.action containing path traversal sequences (e.g., '../../') in the 'filename' query parameter, combined with a JSP file extension in the filename value.
- →Monitor GET requests to /pages/downloadallattachments.action immediately following a suspicious upload, as the exploit triggers this endpoint to move the uploaded webshell to the web root.
- →Alert on HTTP responses with code 200 to newly created .jsp files under /pages/ that were not previously present, indicating successful webshell placement.
- →The exploit authenticates using /dologin.action and then retrieves an XSRF/ATLASSIAN token from the meta tag 'atlassian-token'; monitor for automated login sequences followed immediately by upload and downloadall requests. ↗
- →The Emerging Threats Snort rule (sid:2034261) fires on POST to plugins/drag-and-drop/upload.action with draftId=, filename=, /shell.jsp, atl_token, and JSP scriptlet marker '<%%' in the body on port 8090.
- →Look for the User-Agent string 'python-requests/2.20.0' in requests to Confluence REST API endpoints (/rest/api/space) and upload endpoints, as this is hardcoded in both the standalone and Metasploit exploit modules. ↗
- →The XSRF token is extracted from the HTML meta tag with id 'atlassian-token'; automated scraping of this token followed by upload requests is a strong indicator of exploit activity. ↗
- →The Nuclei template confirms exploitation by checking the HTTP response body of the dropped JSP for a computed arithmetic result (num1*num2), which can be used as a detection canary.
- ·On Linux, Confluence runs under the 'confluence' account which may not have rights to write files to the web root; exploitation may fail in hardened Linux deployments. ↗
- ·On Windows, the web root and the Confluence temporary directory must reside on the same drive for the path traversal write to succeed. ↗
- ·The REST API used to enumerate and create spaces (required for PAGEID=0 fallback) is only available from Confluence Server 5.5 onwards; older instances may not support this exploit path. ↗
- ·The attacker must have at least permission to add attachments to pages/blogs, create a new/personal space, or hold 'Admin' permissions for a space; unauthenticated exploitation is not possible. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vulncheck8.8HIGH
cisa8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qv34-rfhx-fg2q: Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource
ghsa_unreviewed·2022-05-24
CVE-2019-3398 [HIGH] CWE-22 GHSA-qv34-rfhx-fg2q: Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnera
VulnCheck
Atlassian Confluence Server and Data Center Path Traversal Vulnerability
vulncheck·2019·CVSS 8.8
CVE-2019-3398 [HIGH] CWE-22 Atlassian Confluence Server and Data Center Path Traversal Vulnerability
Atlassian Confluence Server and Data Center Path Traversal Vulnerability
Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files. Exploitation can lead to remote code execution.
Affected: Atlassian Confluence Server and Data Center
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Exploit PoC: https://vulncheck.com/xdb/0cf9ade08db1; https://vulncheck.com/xdb/02ff19858062
Remediation Due: 2022-05-03
CISA
Atlassian Confluence Server and Data Center Path Traversal Vulnerability
cisa·2021-11-03·CVSS 8.8
CVE-2019-3398 [HIGH] CWE-22 Atlassian Confluence Server and Data Center Path Traversal Vulnerability
Vulnerability: Atlassian Confluence Server and Data Center Path Traversal Vulnerability
Affected: Atlassian Confluence Server and Data Center
Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files. Exploitation can lead to remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2019-3398
Remediation Due Date: 2022-05-03
Suricata
ET EXPLOIT Confluence Server Path Traversal Vulnerability (CVE-2019-3398)
suricata·2021-10-27·CVSS 8.8
CVE-2019-3398 [HIGH] ET EXPLOIT Confluence Server Path Traversal Vulnerability (CVE-2019-3398)
ET EXPLOIT Confluence Server Path Traversal Vulnerability (CVE-2019-3398)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] 8090 (msg:"ET EXPLOIT Confluence Server Path Traversal Vulnerability (CVE-2019-3398)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"plugins/drag-and-drop/upload.action"; nocase; fast_pattern; content:"draftId="; nocase; distance:0; content:"filename="; nocase; content:"/shell.jsp"; nocase; content:"atl_token"; nocase; http.request_body; content:"<%"; reference:url,github.com/superevr/cve-2019-3398/blob/master/poc.py; reference:cve,2019-3398; classtype:attempted-admin; sid:2034261; rev:1; metadata:created_at 2021_10_27, cve CVE_2019_3398, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_K
Exploit-DB
Atlassian Confluence 6.15.1 - Directory Traversal
exploitdb·2019-11-12·CVSS 8.8
CVE-2019-3398 [HIGH] Atlassian Confluence 6.15.1 - Directory Traversal
Atlassian Confluence 6.15.1 - Directory Traversal
---
# Exploit Title: Atlassian Confluence 6.15.1 - Directory Traversal
# Google Dork: N/A
# Date: 2019-11-11
# Exploit Author: max7253
# Vendor Homepage: https://www.atlassian.com
# Software Link: https://www.atlassian.com/software/confluence/download-archives
# Version: 6.15.1
# Tested on: Microsoft Windows 7 Enterprise, 6.1.7601 Service Pack 1 Build 7601, Linux 5.0.0-23-generic #24~18.04.1-Ubuntu
# CVE : 2019-3398
#Confluence Arbitrary File Write via Path Traversal (CVE-2019-3398)
#To use this exploit you should specify the following variables:
#OS - Linux or Windows.
#PROTO - http or https.
#USERNAME and PASSWORD - the login/password to log into the web interface of the Atlassian Confluence server.
#HOSTNAME - the domain name or IP ad
Exploit-DB
Atlassian Confluence 6.15.1 - Directory Traversal (Metasploit)
exploitdb·2019-11-12·CVSS 8.8
[HIGH] Atlassian Confluence 6.15.1 - Directory Traversal (Metasploit)
Atlassian Confluence 6.15.1 - Directory Traversal (Metasploit)
---
# Exploit Title: Atlassian Confluence 6.15.1 - Directory Traversal (Metasploit)
# Google Dork: N/A
# Date: 2019-11-11
# Exploit Author: max7253
# Vendor Homepage: https://www.atlassian.com
# Software Link: https://www.atlassian.com/software/confluence/download-archives
# Version: 6.15.1
# Tested on: Microsoft Windows 7 Enterprise, 6.1.7601 Service Pack 1 Build 7601, Linux 5.0.0-23-generic #24~18.04.1-Ubuntu
# CVE : N/A
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule "Confluence Arbitrary File Write via Path Traversal (CVE-2019-3398)",
'Description' => %q{
To use this exploit you should specify the following va
Nuclei
Atlassian Confluence Download Attachments - Remote Code Execution
nuclei·CVSS 8.8
CVE-2019-3398 [HIGH] Atlassian Confluence Download Attachments - Remote Code Execution
Atlassian Confluence Download Attachments - Remote Code Execution
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center.
Template:
id: CVE-2019-3398
info:
name: Atlassian Confluence Download Attachments - Remote Code Execution
author: rootxharsh,iamnoooob,pdresearch
severity: high
description: |
Confluence Server and Data Center had a path traversal vulnerability in the
Unit42
Threat Brief: FireEye Red Team Tool Breach
blogs_unit42·2020-12-11
Threat Brief: FireEye Red Team Tool Breach
Threat Research Center
High Profile Threats
Vulnerabilities
## Threat Brief: FireEye Red Team Tool Breach
Unit 42
Published: December 10, 2020
High Profile Threats
Malware
Vulnerabilities
FireEye breach
## Executive Summary
On Dec. 8, 2020, one of the leading cybersecurity companies in the industry, FireEye, reported a breach and data exfiltration unlike any that we have seen previously. What makes this attack unique is not only the target, FireEye being a well-known cybersecurity company, but that the stolen data contains the internal, custom-crafted red-team and penetration testing tools used by the company to imitate different threat actors during customer security consultations. FireEye’s blog provided a wealth of information for defenders to implement security controls
Unit42
Threat Brief: FireEye Red Team Tool Breach
blogs_unit42·2020-12-11
Threat Brief: FireEye Red Team Tool Breach
## Executive Summary
On Dec. 8, 2020, one of the leading cybersecurity companies in the industry, FireEye, reported a breach and data exfiltration unlike any that we have seen previously. What makes this attack unique is not only the target, FireEye being a well-known cybersecurity company, but that the stolen data contains the internal, custom-crafted red-team and penetration testing tools used by the company to imitate different threat actors during customer security consultations. FireEye’s blog provided a wealth of information for defenders to implement security controls and mitigations for defense against the stolen tools. This data is being used by Palo Alto Networks to help ensure our customers are protected if the attackers choose to utilize the tools for malicious purposes.
It i
Fortinet
FireEye Red Team Tool Breach | Fortinet
blogs_fortinet·2020-12-11·CVSS 8.8
[HIGH] FireEye Red Team Tool Breach | Fortinet
PSIRT BLOGS
FireEye Red Team Tool Breach
By Carl Windsor | December 11, 2020
Executive Summary
On December 8th cyber security vendor FireEye reported a breach of their network and data exfiltration which included their internally developed Red Team tools. FireEye took the step of publishing details of these tools in a GitHub repository to allow other vendors to protect against their use by potential adversaries.
This breach has been attributed to a nation state threat actor so we do not expect to see these tools be widely abused in the wild, however with the additional information provided by FireEye, Fortinet have been able to ensure that these tools cannot be abused.
Threat Mitigation
None of the vulnerabilities disclosed as targeted in the tools were zero days, therefore FortiGuard
Qualys
Solorigate/Sunburst : Theft of Cybersecurity Tools | FireEye Breach
blogs_qualys·2020-12-10
Solorigate/Sunburst : Theft of Cybersecurity Tools | FireEye Breach
Update Jan 5, 2021 : New patching section with two new dashboard widgets showing the number of missing FireEye-related patches in your environment and the number of assets in your environment missing one of those patches.
Update Dec 23, 2020 : Added a new section on compensating controls.
Update Dec 22, 2020: FireEye disclosed the theft of their Red Team assessment tools. Hackers now have an influential collection of new techniques to draw upon.
Using Qualys VMDR, the vulnerabilities for Solorigate/SUNBURST can be prioritized for the following Real-Time Threat Indicators (RTIs):
Active Attacks
Solorigate Sunburst ( New RTI )
Original post : On December 8, 2020, FireEye disclosed theft of their Red Team assessment tools. These tools are used by FireEye to test and validate the securit
Qualys
Solorigate/Sunburst : Theft of Cybersecurity Tools | FireEye Breach | Qualys
blogs_qualys·2020-12-10
Solorigate/Sunburst : Theft of Cybersecurity Tools | FireEye Breach | Qualys
Update Jan 5, 2021: New patching section with two new dashboard widgets showing the number of missing FireEye-related patches in your environment and the number of assets in your environment missing one of those patches.
Update Dec 23, 2020: Added a new section on compensating controls.
Update Dec 22, 2020: FireEye disclosed the theft of their Red Team assessment tools. Hackers now have an influential collection of new techniques to draw upon.
Using Qualys VMDR, the vulnerabilities for Solorigate/SUNBURST can be prioritized for the following Real-Time Threat Indicators (RTIs):
- Active Attacks
- Solorigate Sunburst (New RTI)
Original post: On December 8, 2020, FireEye disclosed theft of their Red Team assessment tools. These tools are used by FireEye to test and validate the security
http://packetstormsecurity.com/files/152616/Confluence-Server-Data-Center-Path-Traversal.htmlhttp://packetstormsecurity.com/files/155235/Atlassian-Confluence-6.15.1-Directory-Traversal.htmlhttp://packetstormsecurity.com/files/155245/Atlassian-Confluence-6.15.1-Directory-Traversal.htmlhttp://www.securityfocus.com/bid/108067https://jira.atlassian.com/browse/CONFSERVER-58102https://seclists.org/bugtraq/2019/Apr/33http://packetstormsecurity.com/files/152616/Confluence-Server-Data-Center-Path-Traversal.htmlhttp://packetstormsecurity.com/files/155235/Atlassian-Confluence-6.15.1-Directory-Traversal.htmlhttp://packetstormsecurity.com/files/155245/Atlassian-Confluence-6.15.1-Directory-Traversal.htmlhttp://www.securityfocus.com/bid/108067https://jira.atlassian.com/browse/CONFSERVER-58102https://seclists.org/bugtraq/2019/Apr/33https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3398
2019-04-18
Published
2021-11-03
Added to CISA KEV
Exploited in the wild