CVE-2023-22515 is a critical access control flaw in Atlassian Confluence Data Center and Server that lets remote, unauthenticated attackers create administrator accounts. It affects versions 8.0.0 through 8.5.1 and was added to the CISA Known Exploited Vulnerabilities catalog on 5 October 2023. Upgrade to 8.3.3, 8.4.3, 8.5.2 or later.
What is CVE-2023-22515 in Atlassian Confluence?
CISA, FBI, and MS-ISAC issued a critical security warning, urging network administrators to patch their Atlassian Confluence servers immediately. A severe privilege escalation vulnerability, CVE-2023-22515, poses a significant risk and is actively exploited in attacks. This flaw affects Confluence Data Center and Server versions 8.0.0 through 8.5.1, making it remotely exploitable without user interaction.
Atlassian had already advised users to upgrade to fixed versions after the vulnerability was discovered being actively exploited as a zero-day on October 4. Administrators are advised to isolate affected instances from the internet if upgrading is not possible or shut them down. It’s also crucial for administrators to check for signs of compromise, such as suspicious admin user accounts.
According to Atlassian, fixed versions for Atlassian Confluence Data Center and Confluence Server are;
- 8.3.3 or later
- 8.4.3 or later
- 8.5.2 (Long-Term Support release) or later.
Who is exploiting CVE-2023-22515 and how do you respond?
Microsoft disclosed that a Chinese-backed threat group known as Storm-0062, a.k.a DarkShadow, had been exploiting this flaw as a zero-day since at least September 14, 2023.
The joint warning from CISA, FBI, and MS-ISAC emphasizes the urgency of applying Atlassian’s provided upgrades. It suggests organizations hunt for signs of malicious activity using detection signatures and indicators of compromise. The threat landscape is expected to intensify due to the ease of exploitation and the availability of proof-of-concept exploits.
The history of Confluence servers as attractive targets for cyberattacks, including ransomware and malware campaigns, underscores the importance of immediate patching. This advisory serves as a reminder of the ongoing need for vigilance and prompt action in the face of evolving cybersecurity threats.
Where can I read the official advisory?
You can reach the PDF file for advisory here.