CVE-2023-22515-NSE

This repository provides a tool to check for the presence of the CVE-2023-22515 vulnerability in Atlassian Confluence Server using the Nmap Scripting Engine (NSE).

Overview of CVE-2023-22515

CVE-2023-22515 is a critical vulnerability in Atlassian Confluence Server that allows attackers to:

1. Modify server configurations by sending a request to the vulnerable endpoint: bootstrapStatusProvider.applicationConfig.setupComplete=false.
2. Send a POST request to /setup/setupadministrator.action to create a new administrator account.
3. Authenticate via /rest/api/user?username={username} and potentially compromise the system.

NSE Script for Nmap

The provided NSE script (script.nse) checks for the presence of this vulnerability by:

1. Verifying the software version.
2. Analyzing responses to requests sent to vulnerable routes.

Example for a vulnerable version:

Example for a patched version:

Testing the Script

To test the script:

1. Start the services:

   root@kitploit:~

   docker compose up
   

2. Run the Nmap scan with the NSE script:

   root@kitploit:~

   nmap --script=script.nse -p localhost
   

You can replace localhost with [port] [target] if desired.

---