CVE-2019-3398

CVE-2019-3398 is a path traversal flaw (CWE-22) in the downloadallattachments resource of Atlassian Confluence Server and Data Center that allows arbitrary file writes. An attacker needs limited privileges: permission to add attachments to a page or blog, the ability to create a new space or personal space, or Admin permissions on a space; they can then write files to arbitrary filesystem locations, including paths that yield remote code execution. All Confluence Server/Data Center releases from 2.0.0 onward across the 6.6.x, 6.7.x–6.12.x, 6.13.x, 6.14.x, and 6.15.x lines are affected prior to the listed fixed versions. Because arbitrary file writes on a web application host are commonly used to plant web shells, this flaw aligns with the web-shell activity highlighted in recent NSA/ASD reporting. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and has a very high EPSS score (96.8%), with a public proof-of-concept available.

What to do: Upgrade Confluence Server/Data Center to 6.6.13, 6.12.4, 6.13.4, 6.14.3, or 6.15.2 (or later) per the vendor's instructions, prioritizing internet-facing instances given the KEV listing and near-certain exploitation. In the meantime, restrict permissions to add attachments and create spaces/personal spaces to trusted users, and hunt for signs of compromise such as unexpected files or web shells in the Confluence webroot and other arbitrary-write locations.