Confluence CVE-2023-22518: Unauthenticated Reset to Admin

What to do

1. Back up the instance and data before making changes.
2. Upgrade to exactly a listed fixed release (7.19.16, 8.3.4, 8.4.4, 8.5.3, 8.6.1) or a newer supported version.
3. If you cannot patch now, remove the instance from the internet, including instances that require login.
4. As a stopgap, block /json/setup-restore.action, /json/setup-restore-local.action and /json/setup-restore-progress.action at the proxy or via web.xml, then restart.
5. If any indicator is present, treat the instance as compromised and follow incident response, including restoring from a known-good backup.

How to check if you are affected or compromised

• Search proxy and access logs for requests to `/json/setup-restore*`, e.g. `grep -E '/json/setup-restore' access_log*`.
• Check for loss of admin login, unexpected members of confluence-administrators, and unexpected new users.
• Look for unknown plugins, notably web.shell.Plugin, and requests to /plugins/servlet/com.jsos.shell/ShellServlet.
• On the host, look for the Confluence Java or Tomcat process spawning bash, cmd or PowerShell, files such as /tmp/qnetd, and ransom notes named read-me3.txt.

What happened#

On October 31, 2023, Atlassian published an advisory for CVE-2023-22518, an improper authorization flaw affecting all versions of Confluence Data Center and Server. An unauthenticated attacker can reset Confluence and create a new instance administrator account, then take any admin action. The result is full loss of confidentiality, integrity and availability, including destroying the existing content. Atlassian's CISO warned of significant data loss risk at publication, when no exploitation was known.

That changed within days. Technical details were posted publicly by November 2. On November 3 a customer reported an active exploit, and Atlassian narrowed its fix table to the exact listed versions. On November 6 Atlassian reported multiple active exploits, including ransomware, and raised its CVSS score from 9.1 to 10.0. NVD scores it 9.8.

Rapid7 responded to exploitation across several customer environments on November 5. Process chains were consistent across them, suggesting mass exploitation. Attackers posted to /json/setup-restore.action, used the new admin to upload a web shell plugin, ran whoami, then pulled down payloads that in several cases deployed Cerber ransomware. CISA added the CVE to the KEV catalog on November 7, 2023, flagged for known ransomware use, and it remains listed as of this writing.

Who is affected#

Self-managed Confluence Data Center and Server on any version below the fixed releases: 7.19.16, 8.3.4, 8.4.4, 8.5.3 and 8.6.1. Atlassian says Cloud sites on atlassian.net are not affected. Note that this is a different bug from CVE-2023-22515, the Confluence broken access control flaw disclosed earlier in October 2023.

Do you really need to act?#

If you run self-hosted Confluence that the internet can reach, yes, and it is one of the clearer cases. Exploitation requires no credentials and no user interaction, and has been automated since November 2023. Atlassian specifically told customers to take even login-protected instances off the internet if they could not patch, because the flaw needs no login at all. The damage is not quiet data theft but destruction and ransomware, so the cost of being wrong is high.

Instances reachable only on an internal network carry less risk but are not safe from an attacker already inside. Cloud customers have nothing to do.

What to do now#

1. Back up the instance first.
2. Upgrade to a listed fixed version or a newer supported release. After November 3, Atlassian removed "or later" from its table, so confirm your exact version is listed or newer.
3. If you cannot patch, take the instance off the internet.
4. As a stopgap only, block /json/setup-restore.action, /json/setup-restore-local.action and /json/setup-restore-progress.action at a proxy or with a web.xml security constraint, then restart. Atlassian says this does not replace patching.
5. If any indicator below appears, treat the instance as compromised and restore from a known-good backup.

How to tell if you were hit#

Atlassian's indicators: losing admin login access, requests to /json/setup-restore* in network logs, unknown plugins such as web.shell.Plugin, encrypted or corrupted data, and unexpected members of confluence-administrators or new user accounts. Rapid7 adds host-level signs: requests to /plugins/servlet/com.jsos.shell/ShellServlet, the Confluence Java or Tomcat process spawning bash, cmd or PowerShell, a binary at /tmp/qnetd, and ransom notes named read-me3.txt. Rapid7 also published attacker IP addresses and file hashes.

Timeline#

• Oct 31, 2023 — Atlassian advisory and fixed versions; no known exploitation.
• Nov 2, 2023 — Technical details posted publicly.
• Nov 3, 2023 — Customer reports active exploitation; fix table narrowed.
• Nov 5, 2023 — Rapid7 responds to exploitation leading to Cerber ransomware.
• Nov 6, 2023 — Atlassian confirms multiple exploits and ransomware; CVSS raised to 10.0.
• Nov 7, 2023 — CISA adds CVE-2023-22518 to KEV.

Vulnerability records

• CVE-2023-22518 · KEV 2023-11-07 · All versions of Confluence Data Center and Server are affected by this unexploited vulnerability.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Atlassian — CVE-2023-22518: Improper Authorization Vulnerability in Confluence Data Center and Server confluence.atlassian.com
2. NVD — CVE-2023-22518 nvd.nist.gov
3. CISA — Known Exploited Vulnerabilities Catalog cisa.gov
4. Rapid7 — Rapid7-Observed Exploitation of Atlassian Confluence CVE-2023-22518 rapid7.com