Vulnerabilities and Threats (Corvus Alerts)
      Back to home
      1. Knowledge Nest
      2. Cybersecurity Tips + Vulnerability Alerts
      3. Vulnerabilities and Threats (Corvus Alerts)

      Confluence Vulnerability Alert | October 2023

      Attackers are actively exploiting Confluence Data Center & Server. Here's what you need to know.

      Background

      Confluence issued a security advisory for a critical vulnerability. The flaw, CVE-2023-22515, affects Confluence Data Center & Server commonly used for collaboration and development. The vulnerability allows a remote attacker to perform malicious actions an affected system. We recommend organizations apply security updates immediately due to active exploitation.

      Impact

      This critical privilege escalation flaw affects Confluence Data Center and Server 8.0.0 and later and is described as being remotely exploitable in low-complexity attacks that don't require user interaction. An attacker could gain remote access and perform malicious actions on an affected system. Corvus has observed similar vulnerabilities lead to data theft and extortion as well as ransomware attacks.

      Note: Atlassian Cloud sites are not affected by this vulnerability.

      If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

      Next steps for Confluence Data Center & Server customers:

      1. Update to a fixed version.
        1. 8.3.3 or later
        2. 8.4.3 or later
        3. 8.5.2 (Long Term Support release) or later
      2. If you are unable to upgrade Confluence, as an interim measure we recommend restricting external network access to the affected instance as a workaround.
        1. On each node, modify /<confluence-install-dir>/confluence/WEB-INF/web.xml  and add the following block of code (just before the </web-app> tag at the end of the file):
        2. <security-constraint>
                <web-resource-collection>
                  <url-pattern>/setup/*</url-pattern>
          			<http-method-omission>*</http-method-omission>
          		</web-resource-collection>
                <auth-constraint />
          	</security-constraint>
        3. 

           Restart Confluence.
          

          4. 

        

        3. 

      3. As well as upgrading to a fixed version, we recommend you check all affected Confluence instances for the following indicators of compromise:

          

        1. unexpected members of the confluence-administrator group
          2. 

        2. unexpected newly created user accounts
          3. 

        3. requests to /setup/*.action in network access logs
          4. 

        4. presence of /setup/setupadministrator.action in an exception message in atlassian-confluence-security.log in the Confluence home directory

          5. 

        

        4. 

      

      Resources
      

      https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html