Skip to content

Latest commit

 

History

History

CVE-2023-22518

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
 
 

Atlassian Confluence CVE-2023-22512

Vulnerable setup

You will need to expose a PostgreSQL instance to the confluence environment. You will need the IP address of the docker0 interface (or any other interface that is used by your docker daemon).

In the following example, the IP address 172.17.0.1 is used as an example:

$ docker run --rm --name confluencePG -e POSTGRES_USER=confluence -e POSTGRES_PASSWORD=confluence -e POSTGRES_DB=confluence -p "172.17.0.1:5432:5432" -d postgres
$ docker run --rm --name confluence -d -p 8090:8090 -p 8091:8091 atlassian/confluence:8.5.1-ubuntu-jdk11

Note: The instances are stateless and shutting them down will reset all changes.

Once the instances are running, you can navigate to http:https://127.0.0.1:8090 and start setting up the confluence instance. The vulnerability will only be triggered once the full installation has been finalized.

Non-vulnerable setup

Only the version of the Confluence container needs to be changed:

$ docker run --rm --name confluencePG -e POSTGRES_USER=confluence -e POSTGRES_PASSWORD=confluence -e POSTGRES_DB=confluence -p "172.17.0.1:5432:5432" -d postgres
$ docker run --rm --name confluence -d -p 8090:8090 -p 8091:8091 atlassian/confluence:8.6.1-ubuntu-jdk11