CVE-2023-22518 - Improper Authorization Vulnerability in Confluence Data Center and Server

Summary of Vulnerability

All versions of Confluence Data Center and Server are affected by this vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to a full loss of confidentiality, integrity and availability. 

Publicly accessible Confluence Data Center and Server versions as listed below are at critical risk and require immediate attention. See ‘What You Need to Do’ for detailed instructions.

Severity

Atlassian rates the severity level of this vulnerability as critical (10 with the following vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) per our internal assessment.
This is our assessment, and you should evaluate its applicability to your own IT environment.

Affected Versions

This Improper Authorization vulnerability affects all versions prior to the listed fix versions of Confluence Data Center and Server. Atlassian recommends patching to the fixed LTS version or later.

What You Need To Do

Immediately patch to a fixed version

Atlassian recommends that you patch each of your affected installations to one of the listed fixed versions (or the latest version) below.

Apply temporary mitigations if unable to patch

1. Back up your instance. (Instructions: https://confluence.atlassian.com/doc/production-backup-strategy-38797389.html)
2. Remove your instance from the internet until you can patch, if possible. Instances accessible to the public internet, including those with user authentication, should be restricted from external network access until you can patch.
3. If you cannot restrict external network access or patch, apply the following interim measures to mitigate known attack vectors by blocking access on the following endpoints on Confluence instances:
   1. /json/setup-restore.action
   2. /json/setup-restore-local.action
   3. /json/setup-restore-progress.action

      This is possible at the network layer or by making the following changes to Confluence configuration files.

      1. On each node, modify /<confluence-install-dir>/confluence/WEB-INF/web.xml and add the following block of code (just before the </web-app> tag at the end of the file):

<security-constraint>
		<web-resource-collection>
			<url-pattern>/json/setup-restore.action</url-pattern>
			<url-pattern>/json/setup-restore-local.action</url-pattern>
			<url-pattern>/json/setup-restore-progress.action</url-pattern>
			<http-method-omission>*</http-method-omission>
		</web-resource-collection>
	<auth-constraint />
</security-constraint>

2. Restart Confluence.

Note: These mitigation actions are limited and not a replacement for patching your instance; you must patch as soon as possible

Threat detection

Atlassian cannot confirm if your instances have been affected by this vulnerability. You should engage your local security team to check all affected Confluence instances for evidence of compromise.

Evidence of compromise may include:

• loss of login access to the instance
• requests to /json/setup-restore* in network access logs
• installed unknown plugins
  • we've observed reports of a malicious plugin named web.shell.Plugin
• encrypted files or corrupted data

• unexpected members of the confluence-administrators group

• unexpected newly created user accounts

If any evidence is found, you should assume that your instance has been compromised and follow your security incident response plan. 

Frequently Asked Questions (FAQ)

More details can be found at the Frequently Asked Questions (FAQ) page.

Support

If you did not receive an email for this advisory, and you wish to receive such emails in the future go to https://my.atlassian.com/email and subscribe to Alerts emails. If you have questions or concerns regarding this advisory, please raise a support request at https://support.atlassian.com/.

References