Critical vulnerability in Atlassian Confluence server is under “mass exploitation”
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-22518 | Improper Authorization in Atlassian Confluence Data Center and Server Atlassian Confluence Data Center and Server contain an improper authorization flaw (CWE-863) that can be triggered by an unauthenticated attacker sending crafted requests to a vulnerable instance. Successful exploitation gives the attacker control over the instance and can cause significant data loss, such as wiping or resetting the Confluence site, but there is no confidentiality impact because no data can be exfiltrated. Any organization running a self-managed Confluence Data Center or Server deployment is in scope. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-11-07 with ransomware use noted, and EPSS assigns it a 100% probability of exploitation within 30 days. No public proof-of-concept is known, but ransomware operators are already using the flaw in the wild. Do: Upgrade every Confluence Data Center and Server instance to the patched release for your branch listed in Atlassian's advisory, per the CISA KEV required action (apply vendor mitigations or discontinue use). In the interim, restrict internet access to Confluence and check for signs of compromise such as unexpected instance resets, missing data, or ransom notes; restore from backups if data loss is detected. | 9.8 | 100% | KEV ransomware PoC |
| large≈70,000+ internet-exposed Confluence instances per public scans, likely 100k+ total self-managed installations |
Full article392 words · extracted from arstechnica.com · click to collapse
A critical vulnerability in Atlassian’s Confluence enterprise server app that allows for malicious commands and resets servers is under active exploitation by threat actors in attacks that install ransomware, researchers said.
“Widespread exploitation of the CVE-2023-22518 authentication bypass vulnerability in Atlassian Confluence Server has begun, posing a risk of significant data loss,” Glenn Thorpe, senior director of security research and detection engineering at security firm GreyNoise, wrote on Mastodon on Sunday. “So far, the attacking IPs all include Ukraine in their target.”
He pointed to a page showing that between 12 am and 8 am on Sunday UTC (around 5 pm Saturday to 1 am Sunday Pacific Time), three different IP addresses began exploiting the critical vulnerability, which allows attackers to restore a database and execute malicious commands. The IPs have since stopped those attacks, but he said he suspected the exploits are continuing.
“Just one request is all it takes”
The DFIR Report published screenshots showing data it had collected when observing the attacks. One showed a demand from a ransomware group calling itself C3RB3R.
Screenshot of a ransomware note.
Screenshot of a ransomware note.
Other screenshots showed additional details, such as the post-exploit lateral movement to other parts of the victim’s network and the source of the attacks.
Screenshot showing powershell commands.
Credit: The DFIR Report
Screenshot showing powershell commands. Credit: The DFIR Report
Screenshot of source code.
Credit: The DFIR Report
Screenshot of source code. Credit: The DFIR Report
Screenshot showing 193.187.172.[.]73 as source, along with other details.
Credit: The DFIR Report
Screenshot showing 193.187.172.[.]73 as source, along with other details. Credit: The DFIR Report
Security firms Rapid7 and Tenable, meanwhile, reported also seeing attacks commence over the weekend.
“As of November 5, 2023, Rapid7 Managed Detection and Response (MDR) is observing exploitation of Atlassian Confluence in multiple customer environments, including for ransomware deployment,” company researchers Daniel Lydon and Conor Quinn wrote. “We have confirmed that at least some of the exploits are targeting CVE-2023-22518, an improper authorization vulnerability affecting Confluence Data Center and Confluence Server.
The exploits Rapid7 observed were largely uniform in multiple environments, an indication of “mass exploitation” of on-premises Confluence servers. “In multiple attack chains, Rapid7 observed post-exploitation command execution to download a malicious payload hosted at 193.43.72[.]11 and/or 193.176.179[.]41, which, if successful, led to single-system Cerber ransomware deployment on the exploited Confluence server.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://arstechnica.com/security/2023/11/critical-vulnerability-in-atlassian-confluence-server-is-under-mass-exploitation/