Altassain Confluence: Zero-day exploit discovered

05.10.23

Threat Intelligence Alerts

On October 4, 2023, Atlassian, the company behind the popular workplace software Confluence, released a security advisory for a critical zero-day privilege escalation vulnerability. This means that attackers can exploit this vulnerability to gain full administrative control over Confluence servers, even if they don’t have any existing credentials.

Atlassian says that the vulnerability has been exploited against a “limited set of customers,” but it’s important to note that any Confluence server that is publicly accessible could be at risk. If you use Confluence Server or Data Centre, you should upgrade to the latest version immediately.

How does the Confluence zero-day exploit work?

Atlassian has not released any technical details about the vulnerability, but the Rapid7 blog post mentions that the “/setup/*” endpoints are involved. This suggests that the vulnerability may be related to the Confluence setup process.

What can I do to protect myself?

If you use Confluence Server or Data Centre, you should upgrade to the latest version immediately. Atlassian has released patches for all affected versions of Confluence.

You should also make sure that your Confluence server is not publicly accessible. If your Confluence server is accessible from the internet, you should restrict access to authorised users.

What to do if you think you’ve been affected

If you think your Confluence server may have been affected by this vulnerability, you should immediately change the passwords for all Confluence users, including administrators. You should also scan your server for any malicious activity.

If you’re unsure how to do this, you should contact a security professional for assistance.

Conclusion

The Confluence zero-day exploit is a serious security vulnerability that could allow attackers to gain full control over Confluence servers. If you use Confluence Server or Data Centre, you should upgrade to the latest version as soon as possible.

CVE: Zero-Day Privilege Escalation in Confluence Server & Data Center | Rapid7 Blog

CVE-2023-22515 – Privilege Escalation Vulnerability in Confluence Data Center and Server | Atlassian Support | Atlassian Documentation

Atlassian Ships Urgent Patch for Exploited Confluence Zero-Day – SecurityWeek