{"id":22799899,"url":"https://github.com/chocapikk/cve-2023-22515","last_synced_at":"2025-08-11T06:21:52.619Z","repository":{"id":199578893,"uuid":"703240587","full_name":"Chocapikk/CVE-2023-22515","owner":"Chocapikk","description":"CVE-2023-22515: Confluence Broken Access Control Exploit","archived":false,"fork":false,"pushed_at":"2023-10-17T22:04:13.000Z","size":7,"stargazers_count":132,"open_issues_count":0,"forks_count":29,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-04-19T19:09:32.940Z","etag":null,"topics":["broken-access-control","confluence","cve-2023-22515","exploit","infosec","privilege-escalation","security","vulnerability"],"latest_commit_sha":null,"homepage":"https://attackerkb.com/topics/Q5f0ItSzw5/cve-2023-22515/rapid7-analysis","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Chocapikk.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-10-10T21:40:09.000Z","updated_at":"2025-02-27T14:24:56.000Z","dependencies_parsed_at":"2023-10-11T02:46:45.855Z","dependency_job_id":"3e5b13dd-ad82-4a71-be35-994d44d6cad3","html_url":"https://github.com/Chocapikk/CVE-2023-22515","commit_stats":null,"previous_names":["chocapikk/cve-2023-22515"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Chocapikk/CVE-2023-22515","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chocapikk%2FCVE-2023-22515","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chocapikk%2FCVE-2023-22515/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chocapikk%2FCVE-2023-22515/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chocapikk%2FCVE-2023-22515/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Chocapikk","download_url":"https://codeload.github.com/Chocapikk/CVE-2023-22515/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chocapikk%2FCVE-2023-22515/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":269838558,"owners_count":24483240,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-11T02:00:10.019Z","response_time":75,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["broken-access-control","confluence","cve-2023-22515","exploit","infosec","privilege-escalation","security","vulnerability"],"created_at":"2024-12-12T07:10:11.531Z","updated_at":"2025-08-11T06:21:52.587Z","avatar_url":"https://github.com/Chocapikk.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CVE-2023-22515 Exploit Script 🔐\n\nThis script is designed to exploit the CVE-2023-22515 vulnerability in Confluence, which allows for unauthorized access to Confluence Server and Confluence Data Center instances. The vulnerability is categorized as a Broken Access Control issue and has a CVSS base score of 10.0. ⚠️\n\n## Prerequisites 💻\n\nBefore using this script, make sure you have the following prerequisites in place:\n\n- Python 3.x installed 🐍\n- Required Python packages (`requests`, `fire`, `rich`, and `alive-progress`) installed. You can install them using `pip`:\n\n```shell\npip install -r requirements.txt\n```\n\n## Usage 🚀\n\nThe script provides two main commands for exploiting the vulnerability:\n\n### 1. Normal Mode 🔍\n\nIn normal mode, you can exploit the Confluence vulnerability using a single target URL. Run the following command:\n\n```shell\npython3 exploit.py normal [TARGET_URL] --output-file=[OUTPUT_FILE]\n```\n\nReplace `[TARGET_URL]` with the URL of the Confluence instance you want to target, and `[OUTPUT_FILE]` with the file you'd like to save vulnerable server details to.\n\nExample:\n\n```shell\npython3 exploit.py normal https://example.com/confluence --output-file=vulnerable_servers.txt\n```\n\n### 2. Mass Mode 🔍\n\nIn mass mode, you can exploit the vulnerability using a list of target URLs from a file. Create a text file with one target URL per line and run the following command:\n\n```shell\npython3 exploit.py mass [FILE_NAME] --output-file=[OUTPUT_FILE]\n```\n\nReplace `[FILE_NAME]` with the name of the file containing the list of target URLs, and `[OUTPUT_FILE]` with the file you'd like to save vulnerable server details to.\n\nExample:\n\n```shell\npython3 exploit.py mass targets.txt --output-file=vulnerable_servers.txt\n```\n\n## Example Output ℹ️\n\nThe script will provide information about the exploitation process, such as whether the vulnerability was successfully triggered, whether a new administrator was created, and whether authentication was successful.\n\n```shell\n[INFO] Successfully exploited https://example.com/confluence and logged in as admin!\n```\n\n## Disclaimer ⚠️\n\nThis script is provided for educational and informational purposes only. Use it responsibly and only on systems that you have permission to test. Unauthorized access to computer systems is illegal and unethical. 🚫","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchocapikk%2Fcve-2023-22515","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fchocapikk%2Fcve-2023-22515","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchocapikk%2Fcve-2023-22515/lists"}