Try in Splunk Security Cloud

Description

On October 4, 2023, Atlassian disclosed a critical privilege escalation vulnerability, CVE-2023-22515, affecting on-premises instances of Confluence Server and Confluence Data Center. This flaw might allow external attackers to exploit accessible Confluence instances, creating unauthorized Confluence administrator accounts. Indicators suggest the vulnerability is remotely exploitable. The affected versions range from 8.0.0 to 8.5.1, but versions prior to 8.0.0 and Atlassian Cloud sites are unaffected. Atlassian advises customers to update to a fixed version or implement mitigation strategies. Indicators of compromise (IoCs) and mitigation steps, such as blocking access to /setup/* endpoints, are provided.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Web
  • Last Updated: 2023-10-04
  • Author: Michael Haag, Splunk
  • ID: ead8eb10-9e7c-4a07-a44c-c6e73997a1a3

Narrative

Upon Atlassian’s disclosure of CVE-2023-22515, there’s an immediate need to assess the threat landscape of on-premises Confluence installations. As the vulnerability affects privilege escalation and may be exploited remotely, SIEM solutions should be poised to detect potential threats.
By monitoring for specific indicators of compromise, security teams can get ahead of any potential breaches. Key indicators include unexpected members in the ‘confluence-administrator’ group, newly created user accounts, and specific HTTP requests to /setup/.action endpoints. Any unusual spikes or patterns associated with these indicators might signify an ongoing or attempted exploitation.
Furthermore, an audit trail of past logs is essential. Analyzing older logs might uncover any unnoticed exploitation, allowing for a post-incident analysis and ensuring affected systems are patched or isolated. An alert mechanism should be established for any access or changes related to /setup/ endpoints.
In parallel, updating the affected Confluence Server and Data Center versions to the fixed releases is paramount. If immediate updates aren’t feasible, interim mitigation measures, such as blocking external network access to /setup/*, should be implemented, and logs around this activity should be monitored.

Detections

Name Technique Type
Confluence CVE-2023-22515 Trigger Vulnerability Exploit Public-Facing Application TTP
Confluence Data Center and Server Privilege Escalation Exploit Public-Facing Application TTP
Web Remote ShellServlet Access Exploit Public-Facing Application TTP

Reference

source | version: 1