# MA-980.112023: MyCERT Advisory - Critical Vulnerability in Confluence Server and Data Center

**Date:** 02 Nov 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-980.112023  
**Advisory ID:** MA-980.112023

---

**1.0 Introduction**
Recently, Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.
**2.0 Impact**
This recently disclosed vulnerability affects certain versions of Atlassian Confluence Data Center and Server, enabling malicious cyber threat actors to obtain initial access to Confluence instances by creating unauthorized Confluence administrator accounts. Threat actors exploited CVE-2023-22515 as a zero-day to obtain access to victim systems and continue active exploitation post-patch.
Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an [atlassian.net](http://atlassian.net/) domain, it is hosted by Atlassian and is not vulnerable to this issue.
**3.0 Affected Products**
The Confluence Data Center and Server versions listed below are affected by this vulnerability. Customers using these versions should [upgrade your instance](https://confluence.atlassian.com/doc/upgrading-confluence-4578.html) as soon as possible.
**Versions prior to 8.0.0 are not affected by this vulnerability.**
| Product | Affected Versions | --- | --- | Confluence Data Center and Confluence Server | - 8.0.0 - 8.0.1 - 8.0.2 - 8.0.3 - 8.0.4 - 8.1.0 - 8.1.1 - 8.1.3 - 8.1.4 - 8.2.0 - 8.2.1 - 8.2.2 - 8.2.3 - 8.3.0 - 8.3.1 - 8.3.2 - 8.4.0 - 8.4.1 - 8.4.2 - 8.5.0 - 8.5.1 |
Atlassian recommends that you upgrade each of your affected installations to one of the listed fixed versions (or any later version) below.
| Product | Fixed Versions | --- | --- | Confluence Data Center and Confluence Server | - 8.3.3 or later - 8.4.3 or later - 8.5.2 (Long Term Support release) or later |
For a full description of the latest versions of Confluence Data Center and Confluence Server, see the release notes, [here](https://confluence.atlassian.com/doc/confluence-release-notes-327.html). You can download the latest version from the download center, [here](https://www.atlassian.com/software/confluence/download-archives).
**4.0 Recommendations4.1 Upgrade to a fixed version. (See:** [**Upgrade Instructions**](https://confluence.atlassian.com/doc/upgrading-confluence-4578.html)**)**
Customers with Confluence Data Center and Server instances accessible to the public internet including with user authentication, should restrict external network access until you can upgrade.
If you cannot restrict external network access before your upgrade, apply the following interim measures to mitigate known attack vectors by blocking access to the /setup/\* endpoints on Confluence instances. This is possible at the network layer or by making the following changes to Confluence configuration files.
- On each node, modify */<confluence-install-dir>/confluence/WEB-INF/web.xml*  and add the following block of code (just *before* the *</web-app>* tag at the end of the file):
- <security-constraint>      <web-resource-collection>        <url-pattern>/setup/\*</url-pattern> <http-method-omission>\*</http-method-omission> </web-resource-collection>      <auth-constraint /> </security-constraint>
- Restart Confluence.
This action will block access to setup pages that are not required for typical Confluence usage, for further details see the FAQ page below.
Note: These mitigation actions are limited and not a replacement for upgrading your instance; you must upgrade as soon as possible.
**4.2 Threat detection**
Atlassian cannot confirm if your instances have been affected by this vulnerability. Work with your security team to check all affected Confluence instances for evidence of compromise, as outlined below. If any evidence is found, you should assume that your instance has been compromised and evaluate the risk of flow-on effects. If your Confluence instances have been compromised, these threat attackers hold full administrative access and can perform any number of unfettered actions including - **but not limited to** - exfiltration of content and system credentials, and installation of malicious plugins.
Evidence of compromise may include:
- unexpected members of the confluence-administrators group
- unexpected newly created user accounts
- requests to /setup/\*.action in network access logs
- presence of /setup/setupadministrator.action in an exception message in atlassian-confluence-security.log in the Confluence home directory
If you believe you were compromised, [please raise a support request](https://support.atlassian.com/contact) as Atlassian assistance is required to recover and protect your instance.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
[1]   [Atlassian: CVE-2023-22515 - Broken Access Control Vulnerability in Confluence Data Center and Server](https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html)
[2]   [Rapid7: CVE-2023-22515 Analysis](https://attackerkb.com/topics/Q5f0ItSzw5/cve-2023-22515/rapid7-analysis?referrer=search)
[3]   [Microsoft: CVE-2023-22515 Exploit IP Addresses](https://twitter.com/MsftSecIntel/status/1711871733932671336)
[4]   [Proofpoint: Emerging Threats Rulesets](https://community.emergingthreats.net/c/ruleset-updates/9)
[5]   [Confluence CVE-2023-22515 Proof of Concept - vulhub](https://github.com/vulhub/vulhub/tree/master/confluence/CVE-2023-22515)
[6]   [Atlassian Support: Upgrading Confluence](https://confluence.atlassian.com/doc/upgrading-confluence-4578.html)