CVE-2023-22527 PoC — Atlassian Confluence 安全漏洞

Source

https://github.com/vulncheck-oss/cve-2023-22527

Associated Vulnerability

Title:Atlassian Confluence 安全漏洞 (CVE-2023-22527)
Description:A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

Description

Three go-exploits exploiting CVE-2023-22527 to execute arbitrary code in memory

Readme

# Executing Arbitrary Code In Confluence Memory

[CVE-2023-22527](https://nvd.nist.gov/vuln/detail/CVE-2023-22527) is a widely known vulnerability affecting Atlassian Confluence. Most exploits for this vulnerability use `freemarker.template.utility.Execute()` to execute an operating system command, but they can do so much better. In this repository you'll find three [go-exploit](https://github.com/vulncheck-oss/go-exploit) implementations of CVE-2023-22527 that execute their payload without touching disk (at least until the user directs them to).

You will find the exploits in the following subdirectories

* webshell: loads a webshell into memory
* reverseshell: loads a reverse shell into memory
* nashorn: loads a Nashorn JavaScript reverse shell into memory (only affects Atlassian Confluence using Java below version 15)

## Compiling

All the repositories come with a dockerfile. To build it simply:

```
make docker
```

If you have a Go (and Java) build environment handy, you can also just use `make`:

```
albinolobster@mournland:~/cve-2023-22527/webshell$ make
gofmt -d -w cve-2023-22527.go 
golangci-lint run --fix cve-2023-22527.go
javac ABCDEFG.java -classpath ./lib/servlet-api.jar
Note: ABCDEFG.java uses or overrides a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
GOOS=linux GOARCH=arm64 go build -o build/cve-2023-22527_linux-arm64 cve-2023-22527.go
```

File Snapshot


 [4.0K]  /data/pocs/037d10aabaa5f4fddf715be8962afd81445063d9
├── [ 11K]  LICENSE
├── [4.0K]  nashorn
│   ├── [4.8K]  cve-2023-22527.go
│   ├── [ 466]  Dockerfile
│   ├── [ 877]  go.mod
│   ├── [4.7K]  go.sum
│   ├── [2.1K]  Makefile
│   └── [2.4K]  README.md
├── [1.4K]  README.md
├── [4.0K]  reverseshell
│   ├── [4.9K]  cve-2023-22527.go
│   ├── [ 466]  Dockerfile
│   ├── [ 882]  go.mod
│   ├── [4.7K]  go.sum
│   ├── [2.1K]  Makefile
│   └── [2.3K]  README.md
└── [4.0K]  webshell
    ├── [2.7K]  ABCDEFG.java
    ├── [6.2K]  cve-2023-22527.go
    ├── [ 733]  Dockerfile
    ├── [ 878]  go.mod
    ├── [4.7K]  go.sum
    ├── [4.0K]  lib
    │   └── [279K]  servlet-api.jar
    ├── [2.2K]  Makefile
    └── [2.4K]  README.md

4 directories, 22 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!