Attack Chain

1. The attacker sends an HTTP GET request to /server-info.action endpoint on a vulnerable Confluence server.
2. The GET request includes a modified parameter bootstrapStatusProvider.applicationConfig.setupComplete set to false or 0.
3. The Confluence server incorrectly processes the request due to the vulnerability.
4. The attacker bypasses authentication checks.
5. The attacker gains access to administrative functionalities of the Confluence server.
6. The attacker creates a new administrator account.
7. The attacker logs in to the Confluence server using the newly created administrator account.
8. The attacker gains complete control over the Confluence server, enabling data exfiltration, code execution, or further malicious activities.

Impact

Successful exploitation of CVE-2023-22515 allows attackers to gain full administrative control of vulnerable Atlassian Confluence servers. This can lead to complete data breaches, where sensitive information stored within Confluence is exposed. Attackers can also use their administrative privileges to install malware, pivot to other systems within the network, or cause a denial of service. Numerous organizations across various sectors have been targeted, with the vulnerability actively exploited in the wild.

Recommendation

• Deploy the Sigma rule Confluence CVE-2023-22515 Trigger Vulnerability to your SIEM to detect exploitation attempts based on specific URL patterns and HTTP status codes.
• Enable web server logging and ensure that the logs are being ingested into your SIEM.
• Apply the latest patches for Atlassian Confluence to remediate CVE-2023-22515 on all affected servers.
• Monitor network traffic for suspicious HTTP requests to the /server-info.action endpoint, as detected by the Confluence CVE-2023-22515 Trigger Vulnerability rule.