d3ckkno0b/analyze-exploit-cve-2023-22518-confluenceCVE-2023-22518 exploit analysis for Atlassian Confluence Server covering setup, JAR diffing, root cause, and unauthorized restore to regain admin access.
CVE-2023-22518 in Confluence
CVE-2023-22518 : This vulnerability is described as an "improper authorization vulnerability in Confluence's database and server". The flaw affects On-premises versions of Atlassian products.
Set up the environment. Use the vulnerable version 8.0.4. Download URL: https://product-downloads.atlassian.com/software/confluence/downloads/atlassian-confluence-8.0.4-x64.exe
Select Trial Installation, then click the link to get a free trial key. Then set up the cluster: choose non-cluster
Then go to database setup -> Select MySQL
Follow the instructions:
Download the MySQL driver Drop the .jar file in /home/lily/atlassian/confluence/confluence/WEB-INF/lib Restart Confluence and continue the setup process.
Configure the database, create user and password table
CREATE DATABASE securedb CHARACTER SET utf8mb4 COLLATE utf8mb4_bin;
CREATE USER 'admin123'@'localhost' IDENTIFIED BY 'supersecure';
GRANT ALL PRIVILEGES ON securedb.* TO 'admin123'@'localhost';
GRANT SUPER ON *.* TO 'your_username'@'your_host';
FLUSH PRIVILEGES;
Then edit /etc/mysql/my.cnf. Add the following lines:
transaction-isolation = READ-COMMITTED
log_bin_trust_function_creators = 1
Then restart MySQL and Confluence. Then go to the setup page at localhost:8090 and fill in using the created database
Check connection success, click Next. Then Sign up.
** Diff the jar files of the two versions in IntelliJ **
SystemAdminOnly : Is a feature that restricts administrative functions to administrator accounts only. This helps ensure that only authorized accounts can perform critical operations that affect the system.
Set a breakpoint at validate() in RestoreAction.class
The function saves the uploaded file using getRestoreFileFromUpload
GetExportDescriptor is used to unzip and read the contents of the zip file
However, after debugging, the root cause of the vulnerability has not yet been found.
The cause described in the CVE is an authorization vulnerability. This leads us to direct our attention to research on Java language vulnerabilities in the developer authorization process.
Shift attention to the struts.xml file. This file contains information about actions and routing based on namespaces as well as interceptors.
We can see that the /json namespace enhances the functionality of the /admin namespace. Therefore, routes created for the /admin namespace can also be accessed through the /json namespace.
In the context of the /json namespace, the request routing process involves passing through a chain of interceptors. One of these interceptors, called WebSudoInterceptor, performs checks based on the request URI.
Specifically, WebSudoInterceptor performs the following checks:
If the request path is /authenticate.action, it will be skipped. If the request path is /admin, it will check whether the WebSudoNotRequired attribute is empty.
If a request is sent to '/json', then the request to '/json/action' will be forwarded to '/setup/action' and 'admin/action'. In this CVE, the vulnerable path is '/json/setup-restore.action?synchronous=true'
Capture the request with Burp Suite, GET /json/setup-restore.action. However, a "Method Not Allowed response" was received. Try POST /json/setup-restore.action?synchronous=true and get a 200 response.
Upload the file xmlexport-200123123001.zip
Send and receive the response
Now we can log in with the account admin :admin
And the result is as follows
