C1ph3rX13/CVE-2023-22518

GitHubRepository PoC

PoC files

10 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2023-22518Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment defining a Confluence Server 8.6.0 instance with a PostgreSQL 15.4 database, intended as a target for CVE-2023-22518 exploitation.

docker-compose.yml:1-15

Lab assessment

Vulnerability lab

The README explicitly describes an exploit for CVE-2023-22518, and the Compose file provides a vulnerable Confluence version (8.6.0) as a target.

README.md:1-3docker-compose.yml:4
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

web

vulnerable targetConfluence Server

Runs atlassian/confluence-server:8.6.0, exposes ports 8090 and 5005, and depends on the db service.

docker-compose.yml:3-9

db

database backend

Runs postgres:15.4-alpine with environment variables POSTGRES_PASSWORD=postgres and POSTGRES_DB=confluence.

docker-compose.yml:10-14

CVE-2023-22518.py

exploit script

Python script that checks vulnerability, performs exploit by uploading a zip backup, and uploads a shell plugin (shellplug.jar) to achieve remote code execution.

CVE-2023-22518.py:1-326

shellplug.jar

webshell plugin

A JAR file used by the exploit script to deploy a shell servlet on the Confluence target. BINARY: uninspected.

README.md:10

xmlexport-20231127-071916-1.zip

malicious backup payload

An empty Confluence backup zip used by the exploit script to trigger the restore functionality. BINARY: uninspected.

README.md:9
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-22518

Supported by supplied evidence

The exploit script and README are explicitly designed for CVE-2023-22518, targeting the backup-restore functionality of Confluence.

README.md:1-3CVE-2023-22518.py:1-326
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • A running Confluence Server 8.6.0 instance (provided by the Compose environment).docker-compose.yml:4
  • Valid admin credentials or an authentication bypass to access the setup-restore endpoint.README.md:6
  • A zip file (e.g., xmlexport-20231127-071916-1.zip) in the same directory as the exploit script.CVE-2023-22518.py:55-60
  • The shellplug.jar file in the same directory for the shell upload action.CVE-2023-22518.py:230

Evidence-described exercise path

  1. Start the Docker Compose environment to run Confluence Server 8.6.0 and PostgreSQL.docker-compose.yml:1-15
  2. Run the PoC check: python CVE-2023-22518.py poc -t http://<target>:8090README.md:33-35
  3. Run the exploit: python CVE-2023-22518.py exp -t http://<target>:8090 -id <JSESSIONID>README.md:39-43
  4. Run the shell upload: python CVE-2023-22518.py shell -t http://<target>:8090 -id <JSESSIONID>README.md:47-51
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior targets the lab's own Confluence container. The exploit script uploads a backup and a shell plugin to the Confluence service, which is the intended target. No evidence of host escape, external connections, persistence, or credential theft beyond the lab scope.

CVE-2023-22518.py:1-326docker-compose.yml:1-15
Review boundaries

What the analysis did not establish

  • Binary files shellplug.jar and xmlexport-20231127-071916-1.zip are uninspected; their exact behavior is unknown.
  • The exploit script's shell upload action deploys a webshell, which could be used for further compromise, but no such actions are visible in the supplied evidence.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: 1 binary file not inspected

Linked vulnerabilities

1