CVE-2023-22515-Scan - Scanner for CVE-2023-22515 - Broken Access Control

项目说明

C

About

This is simple scanner for C, a critical in Atlassian Confluence Data Center and Server that is actively being exploited in the wild by threat actors in order "to create unauthorized Confluence administrator accounts and access Confluence instances". The was initially described as a "pri escalation" issue, but Atlassian later changed the classification to "broken access control" in their security ad.

Timeline of C

4 October 2023: Atlassian publishes a security ad on C, which it then described as a critical "pri escalation" in Atlassian Confluence Data Center. The ad covers , patched , workarounds and IOCs.

5 October 2023: US CISA adds C to their Known Exploited Catalog. On the same day, Rapid7 updates their article on C, originally published on 4 October, to mention that Rapid7 security researcher Stephen Fewer has confirmed the to be fully unauthenticated and tri exploitable. The update also mentioned that Rapid7 le the /ser.action endpoint to trigger the issue, which is different from the endpoints mentioned in the Atlassian ad.

6 October 2023: Atlassian edits the description of C in their security ad from "pri escalation" to "broken access control".

C details

This is a simple scanner that will attempt to determinie the status of Atlassian Confluence by performing up to two HTTP GET requests per host and analyzing the reponses:

A GET request to the provided URL (which should be the base URL for the app) to that the target is Atlassian Confluence and to obtain the product .

A GET request to /ser.action to check the response code. Patch diffing showed that the patch for C removes the /ser.action endpoint entirely. During testing, the following behavior was observed for this endpoint:

- Unaffected (before 8.0.0), respond with a 404 status code
- respond with a 200 status code
- Patched respond with a 302 status code

Tested

The scanner has been successfully tested against the following of Atlassian Confluence Server:

7.4.10 (not affected)

8.4.2 ()

8.4.3 (patched)

8.5.0 ()

8.6.0 (latest docker image - patched)

Since the script has been tested against a limited number of of Atlassian Confluence Server, *the scanner may not be fully reliable, especially for Confluence Data Center or for untested of Confluence Server*.

Installation

Clone the repo

Enter the created directory

Install the dependencies with pip. Depending on your local python3 setup, the required commands will be either:

or:

Usage

eg:

statuses

likely : The target is running a (or the could not be detected) and has the /ser.action endpoint a.

likely not exploitable: The target is running a , but the /ser.action endpoint is not accessible, which means it is likely patched.

not : The target is not running a , or the could not be detected and the /ser.action endpoint was not accessible.

unknown: The status could not be determined because an error was encountered while trying to access the /ser.action endpoint.

Output files

c.json - JSON file with the product , status and other relevant information for any systems that were recognized by the script. Example contents:

c.txt - Text file with a human-readable breakdown of the results. This is identical to the report being printed to the console (minus the ANSI colors). Example contents:

Patching

Please refer to the official security ad for information on affected and patched .

Example output

!example_output

项目信息

开发语言：Python

Star 数：80

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Scanner for CVE-2023-22515 - Broken Access Control Vulnerability in Atlassian Confluence展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。