CVE-2023-22518
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
Description
CVE-2023-22518 is a critical improper authorization vulnerability in Atlassian Confluence Data Center and Server that allows an unauthenticated attacker to reset the Confluence instance and create a new administrator account. By exploiting this flaw, an attacker can gain full administrative control over the Confluence instance, leading to complete loss of confidentiality, integrity, and availability of all data stored within the platform. With a maximum CVSS score of 9.8 and an EPSS score of 94.4%, CVE-2023-22518 is under active exploitation and has been confirmed as a vector for ransomware deployment. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, and organizations running self-hosted Confluence instances should treat patching as an emergency priority.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| atlassian | confluence data center | >= 1.0, < 7.19.16; >= 7.20.0, < 8.3.4; >= 8.4.0, < 8.4.4; >= 8.5.0, < 8.5.3; 8.6.0 |
| atlassian | confluence server | >= 1.0, < 7.19.16; >= 7.20.0, < 8.3.4; >= 8.4.0, < 8.4.4; >= 8.5.0, < 8.5.3; 8.6.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907(Issue Tracking, Mitigation, Vendor Advisory)
- https://jira.atlassian.com/browse/CONFSERVER-93142(Issue Tracking, Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22518(US Government Resource)
Weakness Type
CWE-863: Incorrect Authorization
The incorrect authorization weakness in CVE-2023-22518 allows unauthenticated users to access Confluence administrative functions that should be restricted to authorized administrators only. In affected versions of Confluence Data Center and Server, the authorization checks on the instance reset and setup functionality are insufficient, enabling an attacker to bypass access controls and execute the initial setup flow to create a new administrator account, effectively taking complete control of the Confluence instance.
Learn more: CWE-863 — Incorrect Authorization
Impact Analysis
CVE-2023-22518 carries a CVSS v3.1 score of 9.8 (Critical severity) and represents one of the most severe vulnerabilities to affect Atlassian Confluence. The vulnerability is remotely exploitable over the network with Attack Complexity (Low), requiring no special conditions or preparation. Privileges Required (None): No authentication is needed, meaning any attacker with network access to the Confluence instance can exploit this flaw. User Interaction (None): No action from legitimate users is required. The impact across all three CIA triad dimensions is High: Confidentiality (High) means all data stored in Confluence, including sensitive documents, credentials, and proprietary information, can be accessed; Integrity (High) means all content can be modified or destroyed; and Availability (High) means the entire Confluence instance can be rendered inoperable. The EPSS score of 94.4% (99.96th percentile) indicates near-certain exploitation activity. Critically, CISA has flagged this vulnerability as a known ransomware attack vector, meaning threat actors are actively using CVE-2023-22518 to deploy ransomware on compromised Confluence servers.
Exploit Maturity
Public exploit code is available for CVE-2023-22518 via Packet Storm Security, providing a ready-to-use exploitation path for attackers. CISA has confirmed active exploitation in the wild by adding this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 28, 2023. Notably, CVE-2023-22518 is a confirmed ransomware attack vector, with threat actors leveraging the vulnerability to gain administrative access and deploy ransomware payloads on compromised Confluence instances. The EPSS score of 94.4% (99.96th percentile) indicates near-certain exploitation activity, consistent with the availability of public exploit code and the critical nature of the vulnerability that provides full administrative control over the target system.
Remediation
- Patch immediately as directed by CISA and Atlassian: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Refer to Atlassian's security advisory and CONFSERVER-93142 for patched versions.
- Upgrade Confluence Data Center and Server to the latest patched version for your release branch. All versions of Confluence Data Center and Server are affected, so verify that your specific version has been updated to a fixed release as specified in the Atlassian advisory.
- If immediate patching is not possible, restrict external network access to the Confluence instance by placing it behind a VPN or reverse proxy with authentication, and block public internet access entirely until the patch is applied. Pay particular attention to the setup and restore endpoints.
- Audit for indicators of compromise: check for unauthorized administrator accounts, unexpected instance resets or configuration changes, newly installed plugins or applications, and signs of ransomware deployment. Review Confluence access logs for unauthenticated requests to administrative setup endpoints.
- Implement defense-in-depth measures including Web Application Firewall (WAF) rules to block exploit payloads targeting Confluence setup endpoints, network segmentation to limit lateral movement from compromised Confluence servers, and regular backup verification to enable recovery from potential ransomware attacks.
Technical Details
CVE-2023-22518 exploits an incorrect authorization (CWE-863) vulnerability in Atlassian Confluence Data Center and Server. The flaw exists in the authorization logic governing the Confluence instance setup and restore functionality, which fails to properly verify that the requesting user has administrative privileges. An unauthenticated attacker can send crafted requests to the vulnerable endpoints to trigger an instance reset, wiping existing configuration and data, and then complete the initial setup wizard to create a new administrator account under their control. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the maximum impact across confidentiality, integrity, and availability, as the attacker gains complete administrative control over the Confluence instance. Once administrative access is obtained, the attacker can perform any action available to a Confluence administrator, including accessing all stored content, modifying or deleting data, installing malicious plugins for persistent access, and leveraging the compromised server for lateral movement. Atlassian Cloud instances (accessed via atlassian.net domains) are not affected by this vulnerability.
Frequently Asked Questions
Is CVE-2023-22518 being actively exploited?
Yes, CVE-2023-22518 is under active exploitation and has been confirmed as a ransomware attack vector. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 28, 2023. The EPSS score of 94.4% indicates near-certain exploitation activity targeting self-hosted Confluence instances.
What products are affected by CVE-2023-22518?
CVE-2023-22518 affects all versions of Atlassian Confluence Data Center and Confluence Server. Atlassian Cloud sites (those accessed via atlassian.net domains) are not vulnerable. Organizations running self-hosted Confluence installations should check Atlassian's security advisory for the specific patched versions available for their release branch.
How do I fix CVE-2023-22518?
Upgrade your Confluence Data Center or Server installation to the latest patched version as specified in Atlassian's security advisory (CONFSERVER-93142). If immediate patching is not possible, restrict all external access to the Confluence instance and block access to the setup and restore endpoints. See the Remediation section for comprehensive mitigation steps.
How severe is CVE-2023-22518?
CVE-2023-22518 is rated Critical with a CVSS v3.1 score of 9.8 out of 10. The vulnerability allows complete takeover of Confluence instances without authentication, and it has been confirmed as a vector for ransomware deployment. The EPSS score of 94.4% (99.96th percentile) places it among the most actively exploited vulnerabilities currently tracked.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.