CVE-2023-22518

What it actually does

This is a network-reachable improper authorization flaw in Atlassian Confluence Data Center and Confluence Server that allows an unauthenticated attacker to trigger setup/restore behavior, reset the Confluence instance state, and create a new Confluence instance administrator account. Once the attacker has administrative access, they can read, modify, delete, export, or destroy Confluence content; change global configuration; install malicious apps; create additional users; and potentially pivot to the underlying host if Confluence permissions, plugins, or integrations expose further execution paths. Atlassian Cloud sites hosted under atlassian.net are not affected. The supplied package/fixed-version metadata referencing jerryscript appears inconsistent with this Confluence vulnerability and should not be used as the authoritative remediation source for this CVE.

Why it matters to the business

Successful exploitation can result in complete compromise of an organization’s Confluence knowledge base, including sensitive documents, credentials stored in pages, internal procedures, architecture details, and project information. Because the attacker can gain full administrator control, the incident can also cause data destruction, service outage, malicious configuration changes, and ransomware deployment. This vulnerability is in CISA KEV, has been exploited in the wild, has an extremely high EPSS likelihood, and is associated with ransomware activity, so internet-exposed Confluence Server or Data Center instances should be treated as emergency-priority assets. The CISA remediation deadline was 2023-11-28, so any still-vulnerable deployment is significantly overdue for remediation.

How an attack unfolds

An attacker scans for exposed Confluence Server or Data Center instances and probes setup-related endpoints that should not be accessible on a completed installation. The attacker abuses the authorization bypass to manipulate setup or restore workflow state, causing the instance to behave as though setup must be completed or restored. They then create a new Confluence administrator account without prior credentials. With administrator access, the attacker can log in through the normal web interface, export or delete spaces, change configuration, create persistence through additional accounts or plugins, and use the instance to stage further attacks. In observed real-world activity, exploitation has been followed by destructive actions and ransomware deployment, so evidence of setup endpoint access or unexpected administrator creation should be investigated as a potential full compromise, not merely a web application event.

How to fix it

Immediately upgrade affected Confluence Server and Confluence Data Center instances to a fixed Atlassian-supported version. Use Atlassian’s official advisory as the authoritative source; commonly cited fixed branches include 7.19.16 or later, 8.3.4 or later, 8.4.4 or later, 8.5.3 or later, and 8.6.1 or later. If immediate upgrade is not possible, disconnect the instance from the internet or restrict access to trusted networks/VPNs until it is upgraded. Atlassian Cloud sites accessed through an atlassian.net domain are not affected. After patching, perform compromise assessment: review administrator accounts, installed apps, authentication settings, recent exports, space deletions, backup/restore activity, and web/application logs. If exploitation is suspected, consider restoring from a known-good backup taken before compromise, rotating credentials that may have been stored in Confluence, and rebuilding the host if there is evidence of plugin, web shell, or system-level persistence. Do not rely on the jerryscript commit values in the supplied metadata for remediation of this Confluence issue; they appear unrelated.

How to confirm the fix worked

Confirm the deployed Confluence version is at or above an Atlassian fixed version for the active release branch. Verify that the instance is not exposing setup or restore workflows on a completed installation and that unauthenticated users cannot reach sensitive setup endpoints. Review the user directory for unexpected administrator accounts, especially accounts created around or after 2023-10-31. Validate that no unknown apps/plugins are installed and that global configuration, authentication settings, and application links are expected. Check reverse proxy, load balancer, web access, and Confluence application logs for setup/restore endpoint access, unexpected setup-completion changes, and administrator creation events. Where possible, perform an authenticated administrative review and an unauthenticated external exposure test from outside the trusted network.

Typical attack path

1. Identify an internet-accessible Confluence Server or Confluence Data Center instance.
2. Probe Confluence setup, restore, or server-info endpoints to determine whether the instance is vulnerable.
3. Send unauthenticated requests that abuse the improper authorization flaw to alter setup or restore state.
4. Create a new Confluence instance administrator account through the setup workflow.
5. Authenticate to Confluence using the attacker-created administrator account.
6. Use administrator privileges to access, export, modify, or delete Confluence content and configuration.
7. Establish persistence by creating additional privileged users, installing malicious plugins, or modifying authentication settings.
8. Optionally deploy ransomware, destroy data, exfiltrate content, or pivot using credentials and internal information stored in Confluence.

How to detect it

Investigate whether setup, restore, or server-info endpoints were accessed by unauthenticated or unusual source IPs, especially around the first known exploitation window after 2023-10-31. Review reverse proxy, load balancer, WAF, web server, and Confluence access logs for requests to /json/setup-restore.action, /setup/setupadministrator.action, /setup/finishsetup.action, and /server-info.action with setup-related parameters. Correlate these requests with newly created administrator accounts, login events from unfamiliar IP addresses, space exports, backup/restore events, plugin installation, and configuration changes. Examine Confluence application logs for setup state changes, restore jobs, unexpected bootstrap/configuration messages, and account creation events. Review the Confluence home and installation directories for recently modified plugin files, suspicious JSPs, unexpected uploaded archives, and ransomware notes. At the host level, inspect process execution, scheduled tasks/cron jobs, outbound network connections, and file encryption activity around the time of suspicious web requests. Because this vulnerability has been used in ransomware campaigns, also hunt for rapid file modification, ransom note filenames, disabled services, backup deletion, and suspicious archive or encryption tooling.

• /json/setup-restore.action
• /json/setup-restore-local.action
• /setup/setupadministrator.action
• /setup/finishsetup.action
• /server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false
• POST /json/setup-restore.action
• POST /json/setup-restore-local.action
• POST /setup/setupadministrator.action
• POST /setup/finishsetup.action
• GET /server-info.action
• setupComplete=false
• setup-restore.action
• setupadministrator.action
• finishsetup.action
• bootstrapStatusProvider.applicationConfig.setupComplete
• atlassian-confluence.log
• atlassian-confluence-security.log
• confluence.cfg.xml
• confluence-home/restore
• confluence-home/plugins-cache
• confluence-home/bundled-plugins
• confluence-home/temp
• Confluence Administrator
• setup administrator
• C3RB3R
• CERBER
• read_me_for_unlock.txt
• README_FOR_DECRYPT.txt

What your security team should do

• Treat any vulnerable, internet-facing Confluence Server or Data Center instance as a critical incident until proven otherwise because this issue is KEV-listed, actively exploited, and associated with ransomware.
• Patch or isolate all affected Confluence Server and Data Center instances immediately; prioritize externally reachable systems first.
• Perform retrospective threat hunting from at least 2023-10-31 onward, and earlier if logs are retained, for setup, restore, and administrator-creation activity.
• Review all Confluence administrator accounts, recently created users, installed plugins, application links, API tokens, and authentication configuration for unauthorized changes.
• Search for large exports, deleted spaces, unusual backup/restore operations, and suspicious attachment uploads that may indicate data theft or destructive activity.
• If exploitation is suspected, rotate passwords, API tokens, SSH keys, cloud keys, and service credentials that may have been stored in Confluence pages or attachments.
• Preserve Confluence application logs, web server logs, reverse proxy logs, database audit data, and host forensic artifacts before rebuilding or restoring.
• Restrict Confluence administrative access to trusted networks and enforce MFA/SSO where supported.
• Verify backups are intact, offline or immutable, and restorable before making destructive recovery decisions.
• Create SIEM detections for unauthenticated access to Confluence setup and restore endpoints and for new administrator account creation.