Atlassian Confluence Broken Access Control 0-Day CVE-2023–22515 — LetsDefend

CVE-2023–22515 affects certain versions of Atlassian Confluence Data Center and Server, enabling malicious cyber threat actors to obtain initial access to Confluence instances by creating unauthorized

This alert was triggered due to an Atlassian related CVE incident.

Alert informations

The alert describes an incident that occured with a Confluence Data Center. Let’s take note of the source ip address 43.130.1.222 , this will be important when analysing the endpoint and logs.

Let’s check if the attack went through by looking at the Data center’s endpoint.

enpoint investigation of database device of confluence

We can see that the communication was successful with the malicious ip address.

Before we go further, let’s first analyse what this attack is all about.

About CVE-2023–22515

CVE-2023–22515 is an unauthenticated critical severity vulnerability allowing remote attackers to create unauthorized Confluence Administrator accounts and access Confluence instances. Although the vulnerability is categorized as a Broken Access Control, the initial exploitation stage requires Injection which modifies the application’s configuration, granting unrestricted access to Administrator setup endpoints.

The vulnerability affects Confluence versions 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.1.0, 8.1.1, 8.1.3, 8.1.4, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.3.0, 8.3.1, 8.3.2, 8.4.0, 8.4.1, 8.4.2, 8.5.0, 8.5.1 and is fixed in versions 8.3.3, 8.4.3 and 8.5.2 or later.

We can continue by analysing further by going through the logs

log filtering

By filtering only logs that contain the source_ip address, we can analyse and check if the attack went through or not by looking at the response.

Response status code of the attack

A client using the curl/7.88.1 command-line tool sent a GET request to the /server-info.action endpoint, which appears to be related to application configuration or setup status. The server returned a 200 OK response, indicating that the endpoint was accessible and successfully returned information. This activity is consistent with reconnaissance or application enumeration, where a user or automated tool is attempting to gather information about the application's configuration and potential setup functionality. Further investigation of the source IP and related requests is recommended to determine whether this was legitimate activity or part of a broader attack attempt.

second log

A POST request was sent to the /setup/setupadministrator.action endpoint, which appears to be related to administrator account setup or application configuration. The server responded with an HTTP 302 redirect, indicating that the request was processed and the client was redirected to another page. When viewed alongside the earlier access to the server information endpoint, this activity may indicate an attempt to interact with or abuse administrative setup functionality and warrants further investigation to determine whether it was authorized or potentially malicious.

A POST request was observed targeting /setup/finishsetup.action, and the server responded with an HTTP 200 OK, indicating successful processing of the request. When correlated with prior requests to access setup information and administrator configuration endpoints, this activity suggests progression through the application's setup workflow. On a production system, such behavior may indicate an attempt to complete or abuse exposed setup functionality and should be investigated to verify whether the activity was authorized.

Conclusion

The best solution in this case is to upgrade the Confluence platform to either 8.3.3, 8.4.3 or 8.5.2