CVE-2023-22515

What it actually does

CVE-2023-22515 is a critical authentication bypass and broken access control flaw in publicly reachable Atlassian Confluence Data Center and Confluence Server. An unauthenticated remote attacker can abuse setup-related application behavior to create unauthorized Confluence administrator accounts on an already-configured instance. Successful exploitation gives the attacker full administrative control of Confluence, enabling access to pages, attachments, users, groups, configuration, apps, and potentially further execution paths through installed plugins, integrations, or administrative features.

Why it matters to the business

Compromise can expose sensitive documentation, credentials stored in pages, engineering plans, incident records, customer data, and operational runbooks. Because the attacker can create an administrator account without prior access, internet-facing Confluence instances are high-risk targets. This vulnerability is listed in CISA KEV, has a very high EPSS score, has been exploited in the wild, and is associated with ransomware activity, so delayed remediation materially increases the likelihood of data theft, business disruption, extortion, and lateral movement into connected systems.

How an attack unfolds

An attacker first identifies an internet-accessible Confluence Data Center or Server instance. They then send crafted requests to setup-related Confluence endpoints that should not be usable after installation is complete. By manipulating the setup flow, the attacker causes the application to allow creation of a new administrator account without authenticating. The attacker logs in with that administrator account, reviews or exports sensitive content, creates persistence through additional accounts or tokens, changes configuration, installs or abuses apps, and may use Confluence as a foothold for credential theft, web shell deployment through other weaknesses, or ransomware operations. Exploitation has been observed in the wild, so detection should assume that exposed vulnerable instances may already have been probed or compromised.

How to fix it

Upgrade affected Confluence Data Center and Confluence Server instances immediately to a fixed, supported version. Atlassian Cloud sites accessed through an atlassian.net domain are not affected. For self-managed Confluence, upgrade to a current supported release; public Atlassian guidance for this issue included fixed branches such as 8.3.3 or later, 8.4.3 or later, and 8.5.2 or later. If immediate upgrade is not possible, restrict external access to Confluence, block unauthenticated access to setup-related paths at a reverse proxy or WAF, and isolate the instance from the internet until patched. Because exploitation creates administrator accounts, patching alone is not sufficient if compromise is suspected: review all users, groups, API tokens, installed apps, configuration changes, and recent content exports, and rotate credentials that may have been stored in Confluence.

How to confirm the fix worked

Confirm the installed Confluence version is no longer in an affected release line and matches a vendor-fixed supported version. Verify that setup endpoints are not reachable by unauthenticated users after installation. Review reverse proxy, load balancer, and Confluence access logs for requests to /setup/ and related setupadministrator or finishsetup actions. Confirm there are no recently created unknown administrator accounts or unexpected members of the confluence-administrators group. Validate that no suspicious plugins, application links, OAuth consumers, API tokens, or configuration changes were added around the exposure window. Run an authenticated administrative review and compare user, group, and plugin state against known-good baselines or backups.

Typical attack path

1. Scan the internet or target network ranges for reachable Confluence Server or Confluence Data Center instances.
2. Fingerprint the Confluence version and determine whether setup-related endpoints are accessible.
3. Send crafted unauthenticated requests to setup or server-info endpoints to re-enable or abuse administrative setup behavior.
4. Create a new unauthorized Confluence administrator account.
5. Log in using the newly created administrator account.
6. Access, search, export, or modify Confluence content and attachments.
7. Create additional persistence such as extra admin users, API tokens, configuration changes, or malicious plugins where possible.
8. Use information from Confluence to pivot into source control, CI/CD, identity systems, cloud environments, or internal infrastructure.
9. In ransomware campaigns, exfiltrate data and use the foothold to support broader compromise and extortion.

How to detect it

Check whether the Confluence instance was exposed before remediation and review logs back to at least the first known exploitation window, with extra focus around and after the 2023-10-04 disclosure date. Primary sources include web server access logs, reverse proxy logs, WAF logs, load balancer logs, Confluence access logs, Confluence security/audit logs, application logs, identity provider logs, and endpoint or file integrity telemetry from the Confluence server. Look for unauthenticated requests to setup-related paths after the system was already installed, especially setupadministrator.action, finishsetup.action, and server-info.action requests that reference bootstrapStatusProvider.applicationConfig.setupComplete. Investigate any new or unexpected administrator accounts, changes to the confluence-administrators group, new API tokens, new application links, newly installed plugins, unusual configuration changes, and logins from unfamiliar IP addresses. Also look for post-compromise behaviors such as high-volume page or attachment access, space exports, content searches for passwords or keys, failed cleanup attempts, deleted audit records, suspicious outbound connections from the Confluence host, or signs that data from Confluence was used to access other systems. Because this vulnerability has been used in ransomware-related activity, broaden the investigation to connected identity, source control, CI/CD, cloud, and file-sharing systems if exploitation indicators are found.

• /setup/setupadministrator.action
• /setup/finishsetup.action
• /setup/setupadministrator-start.action
• /server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false
• bootstrapStatusProvider.applicationConfig.setupComplete=false
• setupadministrator.action
• finishsetup.action
• server-info.action
• GET /setup/setupadministrator.action
• POST /setup/setupadministrator.action
• GET /setup/finishsetup.action
• POST /setup/finishsetup.action
• GET /server-info.action
• POST /server-info.action
• confluence-administrators
• atlassian-confluence-security.log
• atlassian-confluence.log
• atlassian-confluence-access.log

What your security team should do

• Treat all internet-facing affected Confluence Server and Data Center instances as urgent due to active exploitation, KEV listing, high EPSS, and ransomware association.
• Patch or upgrade immediately to a fixed supported Confluence version; if patching cannot be completed quickly, remove the instance from the internet or restrict access to trusted networks only.
• Search access logs, Confluence application logs, security audit logs, and reverse proxy logs for setup endpoint access, especially requests to setupadministrator.action, finishsetup.action, and server-info.action with bootstrapStatusProvider parameters.
• Audit Confluence administrator users, group memberships, recently created accounts, API tokens, application links, installed apps, and configuration changes.
• Reset passwords and rotate secrets that may have been stored in Confluence pages, attachments, runbooks, or application links if exploitation is suspected.
• Preserve forensic evidence before rebuilding or restoring: application logs, access logs, audit logs, plugin directories, Confluence home, and database backups.
• If unauthorized administrator creation is found, initiate incident response, assume content exposure, investigate lateral movement, and consider rebuilding from a known-good state after patching.
• Add WAF or reverse-proxy detections for access to setup-related endpoints on already-configured Confluence instances.
• Monitor for follow-on activity such as mass page exports, unusual attachment downloads, suspicious admin logins, plugin installation, or connections from unfamiliar source networks.