Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2023-22518 confluence #349

Merged

Conversation

am0o0
Copy link
Contributor

@am0o0 am0o0 commented Nov 21, 2023

related to #342
Thanks to Project discovery for their awsome blog post and exploit.

https://blog.projectdiscovery.io/atlassian-confluence-auth-bypass/

@am0o0 am0o0 changed the title Amammad CVE 2023 22518 confluence Amammad CVE-2023-22518 confluence Nov 21, 2023
@am0o0 am0o0 changed the title Amammad CVE-2023-22518 confluence CVE-2023-22518 confluence Nov 21, 2023
@maoning
Copy link
Collaborator

maoning commented Nov 22, 2023

@amammad could you add links to a vulnerable and a non-vulnerable docker container here?

@am0o0
Copy link
Contributor Author

am0o0 commented Nov 23, 2023

Hii @maoning :)

Please set a Postgres db first, It can be used for both vulnerable and non-vulnerable versions, so please don't re-install it for each confluence version:
The DB username, password, and database name are confluence.

docker run --name confluencePG -e POSTGRES_USER=confluence -e POSTGRES_PASSWORD=confluence -e POSTGRES_DB=confluence -p "0.0.0.0:5432:5432" -d postgres

Please first spin up the vulnerable version because by using this way you can upgrade it without setting up the database docker again:

Setup Vulnerable version:

docker run -v /data/your-confluence-home:/var/atlassian/application-data/confluence --name="confluence" -d -p 8090:8090 -p 8091:8091 atlassian/confluence:8.5.1-ubuntu-jdk11

run the plugin now :)

ShutDown Vulnerable version:

docker stop confluence
docker rm confluence

Setup Non-vulnerable version:

docker run -v /data/your-confluence-home:/var/atlassian/application-data/confluence --name="confluence" -d -p 8090:8090 -p 8091:8091 atlassian/confluence:8.6.1-ubuntu-jdk11

@am0o0
Copy link
Contributor Author

am0o0 commented Nov 23, 2023

for initializing the confluence server you need a trial license, if you can't get one please tell me to send you to your email.

@maoning maoning self-assigned this Nov 27, 2023
@tooryx tooryx self-assigned this Dec 14, 2023
@tooryx
Copy link
Member

tooryx commented Dec 14, 2023

Hi @am0o0,

I will soon be taking a look at this PR, but I see that it is using the @ForWebService annotation, which is sometimes misbehaving. So I would like to improve its behavior first. I will try to make it as fast as possible and will keep you updated, I hope to be able to review your plugin by next week.

~tooryx

The confluence detector requires feature from release 0.0.20
Fix a typo in the description of the plugin, on the CVE number.
Modify exception logging to use format strings.
Merge declaration and initialization of variable `body`
Remove unnecessary newline
Copy link
Member

@tooryx tooryx left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @am0o0,

I made a few minor changes and a few suggestions.
Please review and let me know what you think.

~tooryx

.setSeverity(Severity.CRITICAL)
.setTitle("Atlassian Confluence Data Center Improper Authorization CVE-2023-22515")
.setDescription(
"All versions of Confluence Data Center and Server are affected by this vulnerability."
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a bit misleading: this seems to indicate that there is no possible recommendation (i.e. "all versions are affected"). Could you please rework the description? Maybe skipping completely the first sentence.

"All versions of Confluence Data Center and Server are affected by this vulnerability."
+ " This Improper Authorization vulnerability allows an unauthenticated attacker"
+ " to reset Confluence and create a Confluence instance administrator account.")
.setRecommendation(
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please make this simpler, like "Patch the confluence version to one of the following versions: 7.19.16, [...]"


@VisibleForTesting
String buildRootUri(NetworkService networkService) {
return String.format("http://%s/", toUriAuthority(networkService.getNetworkEndpoint()));
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will not work for https, please use buildWebApplicationRootUrl instead

.addFormDataPart("buildIndex", "false")
.addFormDataPart(
"file",
"someRandomStr14212134.zip",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please consider making someRandomStr14212134 a constant

…_FILE_NAME and RANDOM_ZIP_FILE_CONTENT constants, use `buildWebApplicationRootUrl` to support https
@am0o0
Copy link
Contributor Author

am0o0 commented Dec 18, 2023

@tooryx thanks for the quick review, I hope these changes make this plugin better than before.

@tooryx
Copy link
Member

tooryx commented Dec 18, 2023

Thank you for being so quick to incorporate comments, @am0o0. I will wait for my changes on ForWebService to be public and then I will perform a last review pass on the plugin (I would expect this to happen this week).

@copybara-service copybara-service bot merged commit 934d6f6 into google:master Dec 20, 2023
5 checks passed
@am0o0 am0o0 deleted the amammad-cve-2023-22518-confluence branch April 6, 2024 01:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants