automatic module_metadata_base.json update

Author: msjenkins-r7

db/modules_metadata_base.json

@@ -98721,6 +98721,70 @@
     "session_types": false,
     "needs_cleanup": null
   },
+  "exploit_multi/http/atlassian_confluence_rce_cve_2024_21683": {
+    "name": "Atlassian Confluence Administrator Code Macro Remote Code Execution",
+    "fullname": "exploit/multi/http/atlassian_confluence_rce_cve_2024_21683",
+    "aliases": [
+
+    ],
+    "rank": 600,
+    "disclosure_date": "2024-05-21",
+    "type": "exploit",
+    "author": [
+      "Ankita Sawlani",
+      "Huong Kieu",
+      "W01fh4cker",
+      "remmons-r7"
+    ],
+    "description": "This module exploits an authenticated administrator-level vulnerability in Atlassian Confluence,\n          tracked as CVE-2024-21683. The vulnerability exists due to the Rhino script engine parser evaluating\n          tainted data from uploaded text files. This facilitates arbitrary code execution. This exploit will\n          authenticate, validate user privileges, extract the underlying host OS information, then trigger\n          remote code execution. All versions of Confluence prior to 7.17 are affected, as are many versions\n          up to 8.9.0.",
+    "references": [
+      "CVE-2024-21683",
+      "URL-https://jira.atlassian.com/browse/CONFSERVER-95832",
+      "URL-https://realalphaman.substack.com/p/quick-note-about-cve-2024-21683-authenticated",
+      "URL-https://github.com/W01fh4cker/CVE-2024-21683-RCE"
+    ],
+    "platform": "Linux,Unix,Windows",
+    "arch": "cmd",
+    "rport": 8090,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": [
+      "Default"
+    ],
+    "mod_time": "2024-07-10 20:45:53 +0000",
+    "path": "/modules/exploits/multi/http/atlassian_confluence_rce_cve_2024_21683.rb",
+    "is_install_path": true,
+    "ref_name": "multi/http/atlassian_confluence_rce_cve_2024_21683",
+    "check": true,
+    "post_auth": true,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ],
+      "SideEffects": [
+        "ioc-in-logs"
+      ]
+    },
+    "session_types": false,
+    "needs_cleanup": null
+  },
   "exploit_multi/http/atlassian_confluence_unauth_backup": {
     "name": "Atlassian Confluence Unauth JSON setup-restore Improper Authorization leading to RCE (CVE-2023-22518)",
     "fullname": "exploit/multi/http/atlassian_confluence_unauth_backup",