{"uuid": "bc3f15a0-db17-4c5c-b0d4-194fd5eb6559", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22515", "type": "seen", "source": "https://t.me/hacking_Attack/123375", "content": "Kali Linux Tutorials\nCVE-2023-22515 Scanner \u2013 Detecting Atlassian Confluence Vulnerability\n\nThis is simple scanner for CVE-2023-22515, a critical vulnerability in Atlassian Confluence Data Center and Server that is actively being exploited in the wild by threat actors in order \u201cto create unauthorized Confluence administrator accounts and access Confluence instances\u201d. \n\nThe vulnerability was initially described as a \u201cprivilege escalation\u201d issue, but Atlassian later changed the classification to \u201cbroken access control\u201d in their security advisory. Timeline Of CVE-2023-22515\n\n* 4 October 2023: Atlassian publishes a security advisory\u00a0on CVE-2023-22515, which it then described as a critical \u201cprivilege escalation\u201d vulnerability in Atlassian Confluence Data Center. \n* The advisory covers vulnerable versions, patched versions, workarounds and IOCs.\n\n* 5 October 2023: US CISA adds CVE-2023-22515\u00a0to their Known Exploited Vulnerabilities Catalog. \n* On the same day, Rapid7 updates their article\u00a0on CVE-2023-22515, originally published on 4 October, to mention that Rapid7 security researcher Stephen Fewer\u00a0has confirmed the vulnerabilty to be fully unauthenticated and trivially exploitable. \n* The update also mentioned that Rapid7 leveraged the \"/server-info.action\"\u00a0endpoint to trigger the issue, which is different from the endpoints mentioned in the Atlassian advisory.\n\n* 6 October 2023: Atlassian edits the description of CVE-2023-22515 in their security advisory\u00a0from \u201cprivilege escalation\u201d to \u201cbroken access control\u201d. CVE-2023-22515-Scan Details\n\nThis is a simple scanner that will attempt to determinie the vulnerability status of Atlassian Confluence by performing up to two HTTP GET requests per host and analyzing the reponses:\n\n* A GET request to the provided URL (which should be the base URL for the app) to verifiy that the target is Atlassian Confluence and to obtain the product version.\n* A GET request to \"/server-info.action\"\u00a0to check the response code. Patch diffing showed that the patch for CVE-2023-22515 removes the \"/server-info.action\"\u00a0endpoint entirely. During testing, the following behavior was observed for this endpoint: \n* Unaffected versions (before 8.0.0), respond with a 404 status code\n* Vulnerable versions respond with a 200 status code\n* Patched versions respond with a 302 status code Tested Versions\n\nThe scanner has been successfully tested against the following versions of Atlassian Confluence Server:\n\n* 7.4.10 (not affected)\n* 8.4.2 (vulnerable)\n* 8.4.3 (patched)\n* 8.5.0 (vulnerable)\n* 8.6.0 (latest docker image \u2013 patched)\n\nSince the script has been tested against a limited number of versions of Atlassian Confluence Server,\u00a0the scanner may not be fully reliable, especially for Confluence Data Center or for untested versions of Confluence Server. Installation\n\n* Clone the repo \"git clone https://github.com/ErikWynter/CVE-2023-22515-Scan.git\" \n* Enter the created directory \"cd CVE-2023-22515-Scan\" \n* Install the dependencies with pip. Depending on your local python3 setup, the required commands will be either: \"pip install -r requirements.txt\" \nor: \"pip3 install -r requirements.txt\" Usage \"usage: cve_2023_22515_scan.py [-h] [-f FILE] [-t TARGETS] [-o OUTPUT_DIR]\n\nScan Atlassian Confluence web instances for CVE-2023-22515\n\noptions:\n  -h, --help     show this help message and exit\n  -f FILE        File containing a list of URLs to scan\n  -t TARGETS     Comma-separated list of URLs to scan\n  -o OUTPUT_DIR  Output directory\" \neg: \"python cve_2023_22515_scan.py -f urls.txt -o results\" \"python cve_2023_22515_scan.py -t http://192.168.10.10,http://192.168.10.11 -o results`\" Vulnerability Statuses\n\n* \"likely vulnerable\": The target is running a vulnerable version (or the version could not be detected) and has the vulnerable \"/server-info.action\"\u00a0endpoint available.\n* \"likely not exploitable\": The target is running a vulne[...]", "creation_timestamp": "2026-09-02T01:01:05.714407Z"}