CVE-2023-22515: 
Confluence Server vulnerability analysis and mitigation

A critical authentication vulnerability (CVE-2023-22515) was discovered in Atlassian Confluence Data Center and Server, reported in October 2023. The vulnerability allows external attackers to create unauthorized Confluence administrator accounts and access Confluence instances in publicly accessible installations. This affects versions 8.0.0 through 8.5.1, while versions prior to 8.0.0 and Atlassian Cloud sites (accessed via atlassian.net domain) are not affected (Atlassian Advisory).

The vulnerability is classified as a Broken Access Control vulnerability with a Critical CVSS score of 10.0 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The exploit allows unauthenticated remote threat actors to modify critical configuration settings by leveraging the /setup/setupadministrator.action endpoint after changing the Confluence server's configuration to indicate incomplete setup. The vulnerability is triggered via a request on the unauthenticated /server-info.action endpoint (CISA Advisory, Atlassian FAQ).

If exploited, attackers gain full administrative access to affected Confluence instances, allowing them to perform unrestricted actions including exfiltration of content, theft of system credentials, and installation of malicious plugins. Evidence suggests that a known nation-state actor has been actively exploiting this vulnerability (Atlassian Advisory).

The vulnerability is being actively exploited in the wild, with CISA and FBI expecting widespread, continued exploitation due to its ease of exploitation. Threat actors have been observed using various data exfiltration techniques, including cURL and Rclone, to extract information from compromised systems (CISA Advisory).

Atlassian recommends immediate upgrade to fixed versions: 8.3.3 or later, 8.4.3 or later, or 8.5.2 (LTS) or later. If immediate upgrade is not possible, temporary mitigation involves blocking access to /setup/* endpoints through network layer controls or by modifying the Confluence configuration files. Organizations should also restrict external network access to affected instances until upgrades can be applied (Atlassian Advisory).

The vulnerability has garnered significant attention from security organizations, with CISA adding it to their Known Exploited Vulnerabilities Catalog on October 5, 2023, due to evidence of active exploitation. The FBI and CISA jointly released an advisory warning about the critical nature of this vulnerability and its active exploitation by threat actors (CISA Advisory).