I need to fix CVE-2023-22518 on my confluence server
Asked by ????? ???????????:

I need to fix CVE-2023-22518 on my confluence server, but our license expired, and not compatible with recommended versions, 7.19.16 etc.  
What I can do?


Answers:
author: Ollie Guan
body: Hi [@????? ???????????](/t5/user/viewprofilepage/user-id/3509974) ,

Apply temporary mitigations if unable to patch

1. **Back up your instance.** (Instructions: <https://confluence.atlassian.com/doc/production-backup-strategy-38797389.html>)
2. **Remove your instance from the internet until you can apply the patch, if possible.** Instances accessible to the public internet, including those with user authentication, should be restricted from external network access until you can patch.

<https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html>

comments: author: ????? ???????????
body: So? What does it mean? We can not work without internet.


author: Ollie Guan
body: 1. **If you cannot restrict external network access or patch** , apply the following interim measures to mitigate known attack vectors by blocking access on the following endpoints on Confluence instances:
   1. `/json/setup-restore.action`
   2. `/json/setup-restore-local.action`
   3. `/json/setup-restore-progress.action`

1. This is possible at the network layer or by making the following changes to Confluence configuration files.  
On each node, modify `/<confluence-install-dir>/confluence/WEB-INF/web.xml` and add the following block of code (just before the `</web-app>` tag at the end of the file):  

    <security-constraint>  <web-resource-collection>   <url-pattern>/json/setup-restore.action</url-pattern>   <url-pattern>/json/setup-restore-local.action</url-pattern>   <url-pattern>/json/setup-restore-progress.action</url-pattern>   <http-method-omission>*</http-method-omission>  </web-resource-collection> <auth-constraint /></security-constraint>

<br />

2. Restart Confluence.

<br />

Note: These mitigation actions are limited and not a replacement for patching your instance; you must patch as soon as possible


author: diwakar reddy
body: Thanks for the solution, we have applied the same but still when it is giving the vulnerable warning, how can i check the patch is applied. Could you please suggest us.

Thanks, Diwakar


author: Manjunath MP
body: Hi Diwakar,

We are in the same situation here.

When I tried to apply this patch, we are getting below error message

2023-11-14 11:55:10,319 ERROR \[Catalina-utility-1\] \[ContainerBase.\[Standalone\].\[localhost\].\[/\]\] log For security constraints with URL pattern \[/json/setup-restore.action\] the HTTP methods \[\*\] are uncovered. ?? 2023-11-14 11:55:10,324 ERROR \[Catalina-utility-1\] \[ContainerBase.\[Standalone\].\[localhost\].\[/\]\] log For security constraints with URL pattern \[/json/setup-restore-progress.action\] the HTTP methods \[\*\] are uncovered. ?? 2023-11-14 11:55:10,324 ERROR \[Catalina-utility-1\] \[ContainerBase.\[Standalone\].\[localhost\].\[/\]\] log For security constraints with URL pattern \[/json/setup-restore-local.action\] the HTTP methods \[\*\] are uncovered.   

Any idea on this please?


Tags: confluence-server

cve-2023-22518

server