An Analysis of the Atlassian CVE-2023-22518 Vulnerability

Atlassian has been a target recently for several critical vulnerabilities. These incidents have only highlighted the need to further protect the digital supply chain from attacks and data leaks. In the most recent vulnerability disclosed in November 2023, Atlassian’s on-premise Confluence Data Center and Server were impacted by CVE-2023-22518. 

This recent vulnerability discovery has prompted countless teams to conduct emergency patching measures to ensure they secure systems from threat actors aiming to carry out an attack successfully. 

In this post, we’ll discuss the type of attacks customers could face, an analysis of the vulnerability, and steps to prevent a data breach from this recent exploit. 

Atlassian Confluence Customers Could Face Data Leaks

In a statement released from the Atlassian CISO Bala Sathiamurthy on October 31st, “As part of our continuous security assessment processes, we have discovered that the Confluence Data Center and Server customers are vulnerable to significant data loss if exploited by an unauthenticated attacker. There are no reports of active exploitation at this time; however, customers must take immediate action to protect their instances.”

The CVE was given a severity rating of 9.1 as continuous investigation and monitoring continued for on-prem Confluence data centers and servers was conducted. This vulnerability has been classified to only impact on-premise Confluence data centers and servers with cloud environments not affected. As more information was discovered about the CVE-2023-22518 exploit, additional statements were released to update customers about updates on the vulnerability.

On November 6th the CISO released an update regarding the vulnerability and advising customers of an active exploit with threat actors targeting victims via ransomware. The vulnerability was also upgraded from a 9.1 critical rating to a 10 due to active exploits from attackers. This rating was changed due to the “change in the scope of the attack” with threat actors using ransomware to attack customers' systems resulting in significant data loss. 

Improper Authorization Can Result in Data Loss

Atlassian's most recent exploit, CVE-2023-22518, is classified as an improper authorization vulnerability in the Confluence Data Center and Server setup-restore endpoints. This bug can result in an attacker sending specially composed requests with the necessary inputs to vulnerable endpoints on Confluence Data Center or Server environments. This vulnerability can lead to user privilege escalation capabilities and provide threat actors with unauthorized access to internal resources, applications, or data stored within the Confluence on-premise environment.

Successful execution of this attack can lead to significant data losses as a result of a ransomware attack on the system. The data can then be encrypted from access and held for a ransom requiring a full system restore from the most recent backup as the sole recovery option for on premise Confluence Data Center and Server environments. It can also result in companies having their data exfiltrated from their systems and sold on the dark web by attackers. 

4 Steps That Can Prevent Data Loss from the CVE-2023-22518 Exploit

As of this publication, there has not been any organization that has actively come forward to report an impact from the Confluence CVE-2023-22518 exploit release. However, data exploits to Confluence environments can be prevented in several ways. Below are 4 ways to mitigate the damage of an improper authorization exploit that can result in cyberattacks that lead to data loss. 

1. Deploy the recommended Confluence security patches. 

Regularly updating your Confluence environments for the latest patches can ensure security to the system. As stated by Atlassian, the best remediation to ensure the CVE-2023-22518 vulnerability is mitigated is by deploying the last software patch for all on-prem Confluence data centers and server versions 7.19.16, 8.3.4, 8.4.4, 8.5.3, and 8.6.1. Keeping your instance of Confluence up to date with the latest security patches keeps your environment safe from data loss and leaks. 

2. Backup site data outside of Confluence.

Atlassian also recommends taking systems offline temporarily to mitigate and avoid further exposure in the event of organizations being unable to successfully patch their Confluence instance. In addition to patching, they also recommend backing up site data to a secure location outside of the Confluence environment. This can prevent further data loss and exfiltration in the event of a security incident derived from the Confluence instance. 

3. Implement strong authentication and privilege protocols. 

In case of an improper authorization vulnerability, attackers can bypass security measures, gaining unauthorized access to systems. As a result, threat actors can move across the environment and escalate user permissions to further encrypt data for a ransom.

Implementing strong user authentication in Confluence and adopting a least privilege protocol can mitigate possible privilege escalation issues in the event of an incident.

4. Conduct regular security audits, secret scans, and reviews. 

Ransomware attacks have the capacity to culminate in data exfiltration leading to data theft. Conducting regular security audits and vulnerability scans of your Confluence environment can support mitigating possible data leaks. Routine secret scanning audits are essential to making sure Confluence security risks are identified quickly to prevent further data loss or exposure.

Confluence Secret Scanning from Soteri Can Minimize Your Data Exposure

Many common Confluence vulnerabilities can derive from secrets being stored in your environment. Security for Confluence scans the software for sensitive information published directly in Confluence. This secret scanner can support auditing your Confluence instance and detecting secrets before an attacker can exploit them successfully.

Security for Confluence also supports alerting you regarding any secrets stored in Confluence and prompting you to take action to remedy them quickly. Attacks to the digital supply chain from collaboration tools like Confluence will only increase in severity and complexity over time. Our software can detect over 40 secrets and allows users to add their own scanning rules.

Utilizing scanning solutions to conduct secret scanning for Confluence, Jira, and Bitbucket environments can ensure minimal data exposure or leakage. By employing solutions like Soteri’s Security for Confluence, you can mitigate the risk of data leaks from your digital supply chain more effectively with scanning and removing secrets proactively from your Confluence instance. Contact us today to schedule a demo to ensure your data is secured successfully.