{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "CERT-EU-SA2023-073.pdf"
    },
    "title": "Access Control Vulnerability in Confluence Data Center and Server",
    "serial_number": "2023-073",
    "publish_date": "06-10-2023 08:23:58",
    "description": "Atlassian has been made aware of a critical vulnerability, CVE-2023-22515, a Broken Access Control vulnerability in Confluence Data Center and Server. External attackers may exploit this vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorised Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability.<br>\n",
    "url_title": "2023-073",
    "content_markdown": "---\ntitle: 'Access Control Vulnerability in Confluence Data Center and Server'\nversion: '1.0'\nnumber: '2023-073'\noriginal_date: 'October 4, 2023'\ndate: 'October 6, 2023'\n---\n\n_History:_\n\n* _6/10/2023 --- v1.0 -- Initial publication_\n\n# Summary\n\nAtlassian has been made aware of a critical vulnerability, CVE-2023-22515, a Broken Access Control vulnerability in Confluence Data Center and Server. External attackers may exploit this vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorised Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are **not affected** by this vulnerability.\n\n# Technical Details\n\nExternal attackers can exploit a vulnerability in publicly accessible Confluence Data Center and Server instances. This allows them to create unauthorized Confluence administrator accounts and access the said instances. The vulnerability seems to impact the `/setup/*.action` and `/server-info.action` endpoints but no further technical details are provided yet. \n\n\n# Affected Products\n\n**Confluence Data Center and Server versions:**\n\n- 8.0.0 to 8.0.4\n- 8.1.0 to 8.1.4\n- 8.2.0 to 8.2.3\n- 8.3.0 to 8.3.2\n- 8.4.0 to 8.4.2\n- 8.5.0 to 8.5.1\n\nNote: Versions prior to 8.0.0 are **not affected**.\n\n# Detections\n\nEven after an updating Confluence to a fixed version, ensure you check all affected Confluence instances for:\n\n1. Unexpected members of the `confluence-administrators` group.\n2. Newly created user accounts that were not expected.\n3. Requests to `/setup/*.action` in network access logs.\n4. Presence of `/setup/setupadministrator.action` in an exception message in the Confluence home directory (`atlassian-confluence-security.log`) \n5. Presence of `/server-info.action` in network access logs, as mentionned by Rapid7 [2].\n\n# Recommendations\n\nIt is recommended to upgrade to one of the following fixed versions (or any later version):\n\n- 8.3.3 or later\n- 8.4.3 or later\n- 8.5.2 (Long Term Support release) or later\n\nIf upgrading is not immediately possible, you should:\n\n1. Restrict external network access to the affected instance.\n2. Block access to the `/setup/*` endpoints. This can be done at the network layer or by modifying configuration files as described:\n\n    - On each node, modify `/<confluence-install-dir>/confluence/WEB-INF/web.xml` to include:\n\n    ```xml\n    <security-constraint>\n          <web-resource-collection>\n            <url-pattern>/setup/*</url-pattern>\n    \t\t\t<http-method-omission>*</http-method-omission>\n    \t\t</web-resource-collection>\n          <auth-constraint />\n    \t</security-constraint>\n    ```\n\n    - Restart Confluence.\n\n# References\n\n[1] <https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html>\n\n[2] <https://www.rapid7.com/blog/post/2023/10/04/etr-cve-2023-22515-zero-day-privilege-escalation-in-confluence-server-and-data-center/>",
    "content_html": "<p><em>History:</em></p><ul><li><em>6/10/2023 --- v1.0 -- Initial publication</em></li></ul><h2 id=\"summary\">Summary</h2><p>Atlassian has been made aware of a critical vulnerability, CVE-2023-22515, a Broken Access Control vulnerability in Confluence Data Center and Server. External attackers may exploit this vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorised Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are <strong>not affected</strong> by this vulnerability.</p><h2 id=\"technical-details\">Technical Details</h2><p>External attackers can exploit a vulnerability in publicly accessible Confluence Data Center and Server instances. This allows them to create unauthorized Confluence administrator accounts and access the said instances. The vulnerability seems to impact the <code>/setup/*.action</code> and <code>/server-info.action</code> endpoints but no further technical details are provided yet. </p><h2 id=\"affected-products\">Affected Products</h2><p><strong>Confluence Data Center and Server versions:</strong></p><ul><li>8.0.0 to 8.0.4</li><li>8.1.0 to 8.1.4</li><li>8.2.0 to 8.2.3</li><li>8.3.0 to 8.3.2</li><li>8.4.0 to 8.4.2</li><li>8.5.0 to 8.5.1</li></ul><p>Note: Versions prior to 8.0.0 are <strong>not affected</strong>.</p><h2 id=\"detections\">Detections</h2><p>Even after an updating Confluence to a fixed version, ensure you check all affected Confluence instances for:</p><ol><li>Unexpected members of the <code>confluence-administrators</code> group.</li><li>Newly created user accounts that were not expected.</li><li>Requests to <code>/setup/*.action</code> in network access logs.</li><li>Presence of <code>/setup/setupadministrator.action</code> in an exception message in the Confluence home directory (<code>atlassian-confluence-security.log</code>) </li><li>Presence of <code>/server-info.action</code> in network access logs, as mentionned by Rapid7 [2].</li></ol><h2 id=\"recommendations\">Recommendations</h2><p>It is recommended to upgrade to one of the following fixed versions (or any later version):</p><ul><li>8.3.3 or later</li><li>8.4.3 or later</li><li>8.5.2 (Long Term Support release) or later</li></ul><p>If upgrading is not immediately possible, you should:</p><ol><li>Restrict external network access to the affected instance.</li><li><p>Block access to the <code>/setup/*</code> endpoints. This can be done at the network layer or by modifying configuration files as described:</p><ul><li><p>On each node, modify <code>/&lt;confluence-install-dir&gt;/confluence/WEB-INF/web.xml</code> to include:</p><div class=\"codehilite\"><pre><span></span><code><span class=\"nt\">&lt;security-constraint&gt;</span>\n<span class=\"w\">      </span><span class=\"nt\">&lt;web-resource-collection&gt;</span>\n<span class=\"w\">        </span><span class=\"nt\">&lt;url-pattern&gt;</span>/setup/*<span class=\"nt\">&lt;/url-pattern&gt;</span>\n<span class=\"w\">            </span><span class=\"nt\">&lt;http-method-omission&gt;</span>*<span class=\"nt\">&lt;/http-method-omission&gt;</span>\n<span class=\"w\">        </span><span class=\"nt\">&lt;/web-resource-collection&gt;</span>\n<span class=\"w\">      </span><span class=\"nt\">&lt;auth-constraint</span><span class=\"w\"> </span><span class=\"nt\">/&gt;</span>\n<span class=\"w\">    </span><span class=\"nt\">&lt;/security-constraint&gt;</span>\n</code></pre></div></li><li><p>Restart Confluence.</p></li></ul></li></ol><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html\">https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html</a></p><p>[2] <a rel=\"noopener\" target=\"_blank\" href=\"https://www.rapid7.com/blog/post/2023/10/04/etr-cve-2023-22515-zero-day-privilege-escalation-in-confluence-server-and-data-center/\">https://www.rapid7.com/blog/post/2023/10/04/etr-cve-2023-22515-zero-day-privilege-escalation-in-confluence-server-and-data-center/</a></p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}