Understanding CVE-20 — What It Is and How

Deep Dive into CVE-2023-22515

CVE-2023-22515 is a critical vulnerability impacting Atlassian Confluence Data Center and Server. This flaw allows an unauthenticated attacker to bypass access controls and create a new administrator account. Gaining administrative access leads to a complete compromise of the Confluence instance, including potential remote code execution (RCE) and data exfiltration.

Atlassian initially categorized this as a privilege escalation vulnerability, later reclassifying it as a Broken Access Control issue. The vulnerability carries a CVSS v3.1 base score of 10.0, indicating its critical severity. Affected versions include Confluence Data Center and Server versions 8.0.0 through 8.5.3. Specifically, versions 8.0.0 to 8.5.1 are vulnerable, with fixes released in 8.3.3, 8.4.3, and 8.5.2 and later.

Technical Root Cause Analysis

The core of CVE-2023-22515 lies in a logical flaw within how Atlassian Confluence handles its setup completion status and specific system parameters. Confluence instances, after initial installation, disable access to setup-related endpoints. This prevents unauthorized users from re-running the setup wizard and creating new administrative accounts.

The vulnerability exploits weaknesses in the SafeParametersInterceptor and BootstrapStatusProviderImpl classes, leveraging the Apache Struts framework and XWork package. An attacker can manipulate the Confluence server's configuration to falsely indicate that the server setup is not complete. This manipulation is achieved by sending a crafted HTTP request to an unauthenticated endpoint, specifically /server-info.action.

The critical parameter, bootstrapStatusProvider.applicationConfig.setupComplete, can be set to false via this endpoint. This action effectively re-enables the initial setup process, despite the instance being fully configured. The lack of proper input validation and read-only constraints on these critical configuration objects allows this state change to occur without authentication.

Exploitation Mechanics

Exploiting CVE-2023-22515 involves a sequence of unauthenticated HTTP requests. An attacker first sends a GET request to the /server-info.action endpoint. This request includes a crafted query parameter to set the setupComplete status to false.

GET /server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false HTTP/1.1
Host: [CONFLUENCE_HOST]

A successful response to this request indicates the setup process has been re-enabled. The attacker then accesses the setup administrator endpoint, typically /setup/setupadministrator.action or /setup/setupadministrator-start.action.

On this page, the attacker can create a new administrator account with chosen credentials. This step often involves a POST request, potentially bypassing Cross-Site Request Forgery (CSRF) checks using an X-Atlassian-Token: no-check header. Once the new administrator account is established, the attacker gains full administrative control over the Confluence instance.

With administrative access, an attacker can perform a range of actions. These include exfiltrating sensitive data, modifying content, installing malicious plugins, or deploying web shells to achieve remote code execution on the underlying server. This chain of events demonstrates how a seemingly simple access control bypass escalates to a full system compromise.

Detection: How to Check if You're Affected

Detecting CVE-2023-22515 exploitation requires vigilant monitoring and system auditing. First, verify your Confluence Data Center and Server versions. Any version between 8.0.0 and 8.5.1 is vulnerable.

Review Confluence access logs for suspicious HTTP requests. Look for GET requests to /server-info.action containing the parameter bootstrapStatusProvider.applicationConfig.setupComplete=false. Also, search for POST requests to /setup/setupadministrator.action or similar setup endpoints from unusual IP addresses.

# Example log entries indicating exploitation attempts:
[06/Oct/2023:04:03:00 -0700] - http-nio-8090-exec-7 192.168.86.34 GET /server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false HTTP/1.1 200 21ms 27464 - curl/8.0.1
[06/Oct/2023:04:03:08 -0700] - http-nio-8090-exec-1 192.168.86.34 POST /setup/setupadministrator.action HTTP/1.1 302 1167ms - - curl/8.0.1

Audit Confluence user accounts immediately. Look for newly created, unauthorized administrator accounts or unexpected members in the 'confluence-administrators' group. Changes to existing administrative accounts also warrant investigation.

Secably provides tools to assist with detection. Our free website vulnerability scanner can help identify known vulnerabilities in your web applications. Use our technology stack detector to confirm if Confluence is running on your servers. Internet-wide scanning tools like Zondex can help identify publicly exposed Confluence instances. Monitoring network traffic for the specific URI paths and parameters mentioned is also crucial.

Remediation Steps

Immediate action is critical to mitigate CVE-2023-22515. The primary remediation is to upgrade your Atlassian Confluence Data Center and Server instances to a patched version. Fixed versions include 8.3.3, 8.4.3, 8.5.2, or any later release.

If immediate patching is not feasible, apply temporary workarounds. Restrict external network access to your Confluence instances. Block access to the /setup/* endpoints using a web application firewall (WAF) or network access controls. You can also block access to the /server-info.action endpoint.

Review all Confluence administrator accounts. Remove any unauthorized or suspicious accounts. Rotate credentials for all legitimate Confluence users, especially administrators. Implement strong password policies and multi-factor authentication where possible. Audit Confluence for any unauthorized changes, malicious plugins, or suspicious content modifications. Regularly back up your Confluence data.

Timeline of Disclosure

• September 14, 2023: Microsoft Threat Intelligence observed nation-state actors exploiting the vulnerability as a zero-day.
• October 4, 2023: Atlassian publicly disclosed the vulnerability, CVE-2023-22515, and released an advisory.
• October 5, 2023: CISA added CVE-2023-22515 to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation in the wild.
• October 5, 2023: Security researchers were able to exploit the vulnerability.
• October 10, 2023: Rapid7 published a detailed analysis of the vulnerability and exploitation methods.
• October 12, 2023: Proofpoint released Emerging Threat signatures for detection.
• October 13, 2023: CISA's remediation deadline for federal agencies passed.
• October 16, 2023: CISA, FBI, and MS-ISAC released a joint Cybersecurity Advisory due to widespread, continued exploitation.