CVE-2023-22518: Critical Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

Atlassian warns of public vulnerability details for a critical flaw in Confluence Data Center and Server, as its CISO urges organizations to apply patches immediately

Background

On October 31, Atlassian published an advisory for a critical vulnerability in Confluence Data Center and Server, a popular web-based wiki.

*Please note: Tenable’s Vulnerability Priority Rating (VPR) scores are calculated nightly. This blog post was updated on November 7 and reflects VPR at that time.

According to its advisory, Atlassian says that all versions of Confluence Data Center and Confluence Server are affected by this vulnerability.

Analysis

CVE-2023-22518 is an improper authorization vulnerability in the setup-restore endpoints of Atlassian Confluence Data Center and Server. An attacker could exploit this vulnerability by sending specially crafted requests with the required parameters to the vulnerable endpoints on a Confluence Data Center or Server instance. According to Atlassian’s advisory, successful exploitation of this flaw could result in “significant data loss.” An FAQ blog post from Atlassian notes that successful exploitation would reset an instance’s content, thereby requiring a restore from a backup as the only way to recover the lost data.

Atlassian CISO issues warning to customers

In an unprecedented move, Atlassian’s advisory includes a statement from its chief information security officer (CISO), Bala Sathiamurthy, who specifically called out that “significant data loss” could occur if exploited by “an unauthenticated attacker.” In his note, Sathiamurthy underscored that customers “must take immediate action to protect their instances.”

Publicly available vulnerability details increases risk of potential exploitation

On November 2, Atlassian updated its advisory with an observation that “publicly posted critical information about the vulnerability” had become available, which “increases risk of exploitation.” The information observed includes write-ups about the vulnerability by security researchers, which could be used to develop a working proof-of-concept exploit. The advisory also points out that publicly accessible instances are at the most risk.

Second critical flaw in Atlassian Confluence in the last month

This is the second critical vulnerability disclosed in Atlassian Confluence Data Center and Server in the last month. In October, Atlassian patched CVE-2023-22515, another critical flaw in Confluence Data Center and Server, that was exploited in the wild as a zero-day.

Because Confluence Data Center and Server is often an internet-facing asset, it has become a popular target for cybercriminals over the last few years. As of November 3, no in-the-wild exploitation has been observed for CVE-2023-22518. However, with vulnerability details now public, we anticipate in-the-wild attacks to begin soon.

Widespread exploitation of CVE-2023-22518 has begun

On November 5, our partners at GreyNoise confirmed that "widespread exploitation" of CVE-2023-22518 had begun.

Widespread exploitation of the CVE-2023-22518 authentication bypass vulnerability in Atlassian Confluence Server has begun, posing a risk of significant data loss. #threatintelhttps://t.co/UdKHdTKSJW pic.twitter.com/imEQUQnD4K

— Glenn 📎 (@NTKramer) November 5, 2023

On November 6, researchers at The DFIR Report posted that CVE-2023-22518 is being exploited to distribute the C3RB3R ransomware.

🚨Confluence exploit (CVE-2023-22518) Leads to C3RB3R Ransomware🚨

➡️Exploit source: 193.187.172.73
➡️Download & Exec: http://193[.]187[.]172[.]73/tmp[.]1u
➡️Lateral Movement: Attempts to spread over SMB/445
➡️Extension: LOCK3D

h/t @GreyNoiseIO pic.twitter.com/VdO5EUjPOj

— The DFIR Report (@TheDFIRReport) November 6, 2023

CVSS score for CVE-2023-22518 increased to the highest rating

On November 6, Atlassian updated their security advisory to note that the CVSSv3 score for CVE-2023-22518 has increased from 9.1 to 10, the highest possible rating on the CVSS scale. Atlaissian cites that active exploitation by ransomware groups has resulted in a change in scope for this vulnerability.

Proof of concept

On November 2, write-ups about and exploitation demonstrations of CVE-2023-22518 were published on social media and blog posts. The information contained within these write-ups provide enough information for an attacker to potentially develop their own working proof-of-concept exploit.

analysis for CVE-2023-22518
confluence unauth RCEhttps://t.co/fQrejfcPA6

https://t.co/eNWmwtqcTh https://t.co/aI2Yz1tRNq pic.twitter.com/jfvC4CLrdp

— Henry Chen (@chybeta) November 2, 2023

Solution

Atlassian have released the following fixed versions of Confluence Data Center and Server to address this vulnerability:

If patching is not feasible at this time, Atlassian recommends backing up the Confluence instance and applying the following temporary mitigations until patches can be applied:

• Mitigation #1: Remove instance from the internet until patching is feasible
  • By leaving a vulnerable Confluence instance publicly accessible, they are vulnerable to exploitation, so it is advised that customers restrict external network access until patches can be applied
• Mitigation #2: Block access to vulnerable endpoints on Confluence instances
  • Atlassian highlights three specific endpoints that are known attack vectors:
    • /json/setup-restore.action
    • /json/setup-restore-local.action
    • /json/setup-restore-progress.action
  • Customers are advised to modify the specific Confluence configuration files and adding in a security constraint to block access to these endpoints

For more information about the specific temporary mitigations, please refer to the relevant section in the Atlassian advisory.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability can be located on the individual CVE page for CVE-2023-22518. This link will display all available plugins for this vulnerability, including upcoming plugins in our Plugins Pipeline.

Get more information

• Atlassian Advisory for CVE-2023-22518
• CONFSERVER-93142: Atlassian JIRA Ticket for CVE-2023-22518
• Atlassian FAQ for CVE-2023-22518

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.