Confluence

Exploits

Authentificated RCE: https://github.com/W01fh4cker/CVE-2024-21683-RCE

Unauthentificated RCE: https://github.com/adminlove520/CVE-2023-22527

Unauthentificated RCE: https://github.com/iveresk/cve-2022-26134

Unauthentificated Reset Database: https://github.com/ForceFledgling/CVE-2023-22518

Arbitary File Read: https://github.com/ColdFusionX/CVE-2021-26085

Unauthentificated RCE: https://github.com/ZZ-SOCMAP/CVE-2021-26084

Post-Exploit

Password reset

Connect to database. User admin with pass admin

update cwd_user set credential='{PKCS5S2}8WEZjkCbLWysbcbZ5PRgMbdJgJOhkzRT3y1jxOqke2z1Zr79q8ypugFQEYaMoIZt' where user_name='admin';

Config locate

confluence.cfg.xml contains database credentials and jwt keys.