Atlassian Confluence broken access control

What it does

A request to /server-info.action with a crafted parameter re-enables the initial setup state of Confluence. From there, the unauthenticated setup endpoint /setup/setupadministrator.action can be used to create a new administrator.

Exploitation was observed before disclosure by a nation-state actor tracked as Storm-0062, followed by broad opportunistic exploitation within days.

Confluence Cloud is not affected. Only self-hosted Data Center and Server instances reachable from the internet are at risk.

Remediation

1. Upgrade to 8.3.3, 8.4.3, 8.5.2 or later.
2. Check the user directory for unexpected administrator accounts and review the atlassian-confluence.log for requests to /setup/ endpoints.
3. Restrict internet access to Confluence, or at minimum block the /setup/* path at the reverse proxy.

Enumeration

Detection templates and scanners you can run to find exposed instances on your own attack surface.

$ nuclei -id CVE-2023-22515 -u https://TARGET

Exploitation

Working exploit modules and public PoCs. Use only against systems you own or are authorized to test.

$ msfconsole -q -x "use exploit/multi/http/atlassian_confluence_rce_cve_2023_22515; show options"

References

• Atlassian security advisoryconfluence.atlassian.com
• CISA advisory AA23-289Awww.cisa.gov
• NVD recordnvd.nist.gov