Atlassian Confluence Server critical flaw exploited by hackers

Atlassian reported the exploitation of a critical vulnerability in on-premises versions of Confluence Server and Confluence Data Center, allowing malicious actors to create and misuse admin accounts within the enterprise collaboration software.

Tracked as CVE-2023-22515, this privilege-escalation vulnerability affects versions 8.0.0 through 8.5.1, with versions before 8.0.0 remaining unaffected.

Public-facing instances are at risk, as anyone with access to a vulnerable deployment of Confluence can attempt exploitation to gain admin-level access anonymously. A few customers have already fallen victim to this zero-day vulnerability, prompting the availability of updates to strengthen installations.

Specific details about the vulnerability and the extent of customer compromise were not disclosed to mitigate broader exploiting Atlassian confirmed that Atlassian Cloud sites were not affected.

A possible mitigation step is to block access to the /setup/* endpoints on Confluence instances. This is possible at the network layer or by making changes to Confluence configuration files.

On each node, modify /<confluence-install-dir>/confluence/WEB-INF/web.xml  and add the following block of code (just before the </web-app> tag at the end of the file):

<security-constraint>
      <web-resource-collection>
        <url-pattern>/setup/*</url-pattern>
			<http-method-omission>*</http-method-omission>
		</web-resource-collection>
      <auth-constraint />
	</security-constraint>

Restart Confluence.