Full Report
CVE-2023-22518 is being exploited in Confluence for Cerber ransomware deployment. Read up on Huntress’ observations and mitigation guidance.
Analysis Summary
# Vulnerability: Confluence Improper Authorization Exploited for Cerber Ransomware
## CVE Details
- **CVE ID:** CVE-2023-22518
- **CVSS Score:** 9.1 (Critical)
- **CWE:** CWE-285 (Improper Authorization)
## Affected Systems
- **Products:** Atlassian Confluence Data Center, Atlassian Confluence Server.
- **Versions:** All versions prior to the patched releases listed below.
- **Configurations:** Publicly accessible (Internet-facing) instances are at highest risk.
## Vulnerability Description
CVE-2023-22518 is an improper authorization vulnerability that allows an unauthenticated attacker to reset the Confluence instance and create an initial administrator account. With administrative access, attackers can execute arbitrary code on the underlying server, leading to full system compromise. In the observed campaign, this access was used to deploy ransomware.
## Exploitation
- **Status:** Exploited in the wild (Actively used for Cerber/C3RB3R ransomware deployment since early November 2023).
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** High (Ransomware deployment results in total loss of data availability).
## Remediation
### Patches
Atlassian released the following fixed versions:
- 7.19.16
- 8.3.4
- 8.4.4
- 8.5.3
- 8.6.1
### Workarounds
If patching is not immediately possible:
- Disconnect affected instances from the public internet.
- Implement strict IP whitelisting for Confluence access.
- Back up all Confluence data to an offsite, immutable location.
## Detection
- **Indicators of Compromise (IoCs):**
- **Malicious IP:** `193.176.179[.]41`
- **File Name:** `svcPrvinit.exe` (Saved in `%TEMP%` directory)
- **SHA256 Hash (Cerber):** `f2e17ec85c3f8ee26a3be3ce52c6e140448941d705a9bdedb7c1aa82a9d9707f`
- **Encrypted File Extension:** `.L0CK3D`
- **Detection Methods:**
- Monitor for encoded PowerShell commands attempting to use `Net.WebClient` or `DownloadString`.
- Audit Confluence logs for unauthorized access to setup/administrative endpoints.
- Monitor for unexpected processes spawned by the Confluence user (e.g., `cmd.exe`, `powershell.exe`).
## References
- **Vendor Advisory:** hXXps://confluence.atlassian[.]com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html
- **Huntress Analysis:** hXXps://www.huntress[.]com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment