CVE-2023-22518: Atlassian exploited

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

What it is

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Description quoted from the CVE record (assigned by atlassian, published 2023-10-31).

Weakness: CWE-863 Incorrect Authorization

How it can be exploited

Exploitable over the network with low attack complexity needing no privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA assessment (SSVC): CISA assesses exploitation as active. Automatable: yes. Technical impact: partial.

On CISA KEV since: 2023-11-07
US federal deadline: 2023-11-28
Ransomware use: Yes

Public exploit evidence (Exploit Observer)

Exploit Observer found 1 Nuclei template, 21 code repositories and 2 research write-ups naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 32 references on Exploit Observer

Live scores

EPSS: 1.000
very likely to be attacked soon
VEDAS: 0.987
strong exploit evidence
On CISA KEV: Yes, since 2023-11-07
Detection rule: Nuclei · Suricata

EPSS (chance of attack)

VEDAS (exploit evidence)

Thin horizontal line: the “likely exploited” threshold (EPSS 0.10, VEDAS 0.5). Shaded “no data” areas are periods when cve-scores did not publish.

Who is affected

Product	Affected	Not affected
Atlassian Confluence Data Center	version >= 1.0.0	< 1.0.0 is not affected; >= 7.19.16 is not affected; >= 8.3.4 is not affected; >= 8.4.4 is not affected
Atlassian Confluence Server	version >= 1.0.0	< 1.0.0 is not affected; >= 7.19.16 is not affected; >= 8.3.4 is not affected; >= 8.4.4 is not affected

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vendor guidance:

How to detect it

Nuclei template (active check)

Atlassian - Authorization Bypass
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (POST /json/setup-restore.action); it decides using dsl matchers. Severity in the template: critical. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash

nuclei -u https://your-host -t CVE-2023-22518.yaml

Show the template (49 lines)

yaml

id: CVE-2023-22518

info:
  name: "Atlassian - Authorization Bypass"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This
    Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a
    Confluence instance administrator account.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2023-22518&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=atlassian&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-22518
    cwe-id: CWE-863
  metadata:
    verified: false
  tags: cve,cve2023,atlassian,confluence,rce,unauth,intrusive,kev,vkev,vuln
http:
  - raw:
      - |
        POST /json/setup-restore.action HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryT3yekvo0rGaL9QR7
        X-Atlassian-Token: no-check

        ------WebKitFormBoundaryT3yekvo0rGaL9QR7
        Content-Disposition: form-data; name="buildIndex"

        false
        ------WebKitFormBoundaryT3yekvo0rGaL9QR7
        Content-Disposition: form-data; name="file";filename="{{randstr}}.zip"

        {{randstr}}
        ------WebKitFormBoundaryT3yekvo0rGaL9QR7
        Content-Disposition: form-data; name="edit"

        Upload and import
        ------WebKitFormBoundaryT3yekvo0rGaL9QR7--

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_all(body,'The zip file did not contain an entry', 'exportDescriptor.properties')"
        condition: and

CVE-2023-22518.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2023-22518 Atlassian - Authorization Bypass. Add them to your Suricata rule set and reload.

Show the rules

suricata

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2023-22518 Atlassian - Authorization Bypass"; flow:established,to_server; http.uri; content:"/json/setup-restore.action"; nocase; fast_pattern; classtype:web-application-attack; reference:cve,CVE-2023-22518; reference:url,https://www.exploit.observer/?keyword=CVE-2023-22518&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=atlassian&match=exact; sid:1009778; rev:1;)

CVE-2023-22518.rules on GitHub

Advisories on this CVE

Synology warns of active C3RB3R (Cerber) ransomware hitting NAS devices through a patched DSM flaw (full advisory)

References

Government sources

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22518 (government-resource)

Other references

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, CISA KEV, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.