CVE-2023-22515.yaml

id: CVE-2023-22515

info:
  name: CVE-2023-22515
  author: rxerium
  severity: critical
  description: Detects if the Atlassian Confluence instance is running a vulnerable version.

http:
  - method: GET
    path:
      - "{{BaseURL}}/dologin.action"
      - "{{BaseURL}}"
      - "{{BaseURL}}/pages"
      - "{{BaseURL}}/confluence"
      - "{{BaseURL}}/wiki"

    host-redirects: true
    stop-at-first-match: true

    matchers:

      - type: regex
        regex:
          - "8.0.0$"
          - "8.0.1$"
          - "8.0.2$"
          - "8.0.3$"
          - "8.0.4$"
          - "8.1.0$"
          - "8.1.1$"
          - "8.1.3$"
          - "8.1.4$"
          - "8.2.0$"
          - "8.2.1$"
          - "8.2.2$"
          - "8.2.3$"
          - "8.3.0$"
          - "8.3.1$"
          - "8.3.2$"
          - "8.4.0$"
          - "8.4.1$"
          - "8.4.2$"
          - "8.5.0$"
          - "8.5.1$"
        part: version

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - '<meta name="ajs-version-number" content="(.*)">'
          - 'Atlassian Confluence ([a-z0-9-._]+)'
        internal: true

      - type: kval
        kval:
          - version