CVE-2023-22515:

Unauthenticated Remote Code Execution Vulnerability in Atlassian Confluence

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.8Critical

Published Date:Oct 4, 2023
CISA KEV Date:Oct 5, 2023
Industries Affected:20

Armis Early Warning:

1 Days

Threat Predictions

EPSS Score:94.3
EPSS Percentile:100%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Unauthenticated Remote Code Execution Vulnerability in Atlassian Confluence

Overview

This vulnerability allows unauthenticated attackers to exploit a flaw in Confluence Data Center and Server to create administrator accounts without authorization. Once an attacker creates an admin account, they can execute arbitrary code on the server, access sensitive information, and potentially compromise the entire system. The vulnerability has been actively exploited by threat actors to deploy web shells, cryptocurrency miners, and other malicious payloads. The issue is particularly dangerous because it requires no authentication and affects default configurations of Confluence installations that are exposed to the internet.

Remediation

1. Immediately update Confluence Data Center and Server to one of the following fixed versions:
8.5.3
8.4.3
8.3.4
8.2.4
8.1.5
8.0.6
7.19.16
2. If immediate patching is not possible:
Restrict network access to your Confluence server
Implement IP-based access controls
Deploy a web application firewall with rules to block exploitation attempts
3. After patching:
Conduct a thorough security audit of your Confluence instance
Review all user accounts, particularly administrator accounts
Check for unauthorized changes or suspicious activities
Scan for potential backdoors or malware that may have been installed
4. If you suspect compromise:
Isolate the affected system
Restore from a known clean backup
Reset all credentials
Monitor for unusual network activity