CVE-2023-22527 PoC — Atlassian Confluence 安全漏洞

Source

https://github.com/RevoltSecurities/CVE-2023-22527

Associated Vulnerability

Title:Atlassian Confluence 安全漏洞 (CVE-2023-22527)
Description:Atlassian Confluence是澳大利亚Atlassian公司的一套专业的企业知识管理与协同软件，也可以用于构建企业WiKi。 Atlassian Confluence Data Center and Server存在安全漏洞，该漏洞源于存在模板注入漏洞，允许未经身份验证的攻击者在受影响的实例上实现远程代码执行。

Description

An Exploitation tool to exploit the confluence server that are vulnerable to CVE-2023-22527 leads to RCE

Readme

# CVE-2023-22527
An Exploitation tool to exploit the confluence server that are vulnerable to CVE-2023-22527 leads to RCE which tested and proven POC
in vulnerable instance of confluence data center and servers. By this an attacker can execute arbitary code on vulnerable instance


### Installation:

```bash
git clone https://github.com/sanjai-AK47/CVE-2023-22527.git
cd CVE-2023-22527
pip install -r requirements.txt
python3 exploit.py -h
```

### Usage:
```yaml
python3 exploit.py -h                                                                         
usage: exploit.py [-h] [-d DOMAIN] [-dL DOMAINS_LIST] [-cmd COMMAND] [-c CONCURRENCY] [-o OUTPUT] [-to TIME_OUT] [-px PROXY] [-v]

[DESCTIPTION]: Exploitation and Detection tool for Cisco CVE-2023-46747

options:
  -h, --help            show this help message and exit
  -d DOMAIN, --domain DOMAIN
                        [INFO]: Target domain for exploiting without protocol eg:(www.domain.com)
  -dL DOMAINS_LIST, --domains-list DOMAINS_LIST
                        [INFO]: Targets domain for exploiting without protocol eg:(www.domain.com)
  -cmd COMMAND, --command COMMAND
                        [INFO]: Give your burp collabarator url for exploitation
  -c CONCURRENCY, --concurrency CONCURRENCY
                        [INFO]: Give your burp collabarator url for exploitation
  -o OUTPUT, --output OUTPUT
                        [INFO]: File name to save output
  -to TIME_OUT, --time-out TIME_OUT
                        [INFO]: Switiching timeout will requests till for your timeout and also for BURPSUITE
  -px PROXY, --proxy PROXY
                        [INFO]: Switiching proxy will send request to your configured proxy (eg: BURPSUITE)
  -v, --verbose         [INFO]: Switiching Verbose will shows offline targets

```

### Proof Of Exploitation:


[exploit.webm](https://github.com/sanjai-AK47/CVE-2023-22527/assets/119435129/c1ed2eea-700b-4eeb-aa71-2d3dac7da000)

## Information:

Important thing if any unethical exploitation the I'm not responsible for any illegal actions so plese use this for ethical and legal purposes

Proof of conept Developed by [D.Sanjai Kumar](https://www.linkedin.com/in/d-sanjai-kumar-109a7227b/) with ♥️ for any upgrade and miscoded contact me throguh my [LinkedIn](https://www.linkedin.com/in/d-sanjai-kumar-109a7227b/). Thank you!

File Snapshot


 [4.0K]  /data/pocs/0d0fb87fdbde9a7d27875b4d1fd81443af95b2f6
├── [8.7K]  exploit.py
├── [1.0K]  LICENSE
├── [2.3K]  README.md
└── [ 149]  requirements.txt

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!