pwn.watch: Confluence incident updates

[high] Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach

Thu, 01 Feb 2024 00:00:00 GMT

A suspected nation-state attacker used one access token and three service account credentials stolen in the October Okta breach, which Cloudflare had failed to rotate, to get into Cloudflare's Atlassian Confluence, Jira and Bitbucket. Cloudflare said customer data and systems were not affected.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-02-01: Cloudflare publishes its full write-up (source)
2023-11-23: Cloudflare detects the attacker on its self-hosted Atlassian server (source)
2023-11-14: Attacker begins reconnaissance with credentials from the Okta compromise (source)

[critical] Atlassian Confluence Data Center and Server Template Injection

Wed, 24 Jan 2024 00:00:00 GMT

Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution. Added to the CISA KEV catalog on 2024-01-24. CISA lists known use in ransomware campaigns. CVE-2023-22527 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-24: CISA added CVE-2023-22527 to the KEV catalog (federal deadline 2024-02-14) (source)
2024-01-16: CVE-2023-22527 published (source)

CVEs: CVE-2023-22527

[critical] Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)

Tue, 07 Nov 2023 00:00:00 GMT

An improper authorization bug let unauthenticated attackers reset Confluence Data Center and Server and create a new admin. Within days of disclosure it was exploited to deploy Cerber ransomware. Atlassian Cloud was not affected.

Status: closed · Patch: patched · Fixed in: 7.19.16, 8.3.4, 8.4.4, 8.5.3, 8.6.1

Latest updates:

2023-11-07: CISA adds CVE-2023-22518 to the KEV catalog
2023-11-06: Atlassian raises the CVSS score to 10 after active exploitation and Cerber ransomware deployments
2023-10-31: Atlassian discloses CVE-2023-22518 and ships fixes (source)

CVEs: CVE-2023-22518

[critical] Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)

Mon, 16 Oct 2023 00:00:00 GMT

A broken access control bug in publicly reachable Confluence Data Center and Server let outside attackers create Confluence administrator accounts. It was exploited as a zero-day, and Microsoft attributed it to the China-nexus Storm-0062. Atlassian Cloud was not affected.

Status: closed · Patch: patched · Fixed in: 8.3.3, 8.4.3, 8.5.2 (LTS)

Latest updates:

2023-10-16: CISA, FBI and MS-ISAC joint advisory AA23-289A on active exploitation (source)
2023-10-05: CISA adds CVE-2023-22515 to the KEV catalog
2023-10-04: Atlassian discloses the zero-day after customer reports and ships fixes (source)

CVEs: CVE-2023-22515