Confluence Webserver: CVE-2023-22518 POST Requests to Vulnerable Setup/Restore Endpoints

title: "Confluence Webserver: CVE-2023-22518 POST Requests to Vulnerable Setup/Restore Endpoints"
id: e0db7091-5538-4cb7-a496-0df263354212
related:
  - id: 27d2cdde-9778-490e-91ec-9bd0be6e8cc6
    type: similar
  - id: a902d249-9b9c-4dc4-8fd0-fbe528ef965c
    type: derived
status: test
description: This rule flags webserver activity where POST requests target specific Confluence setup, restore, server-info, and setup-administrator endpoints with response codes consistent with 200, 302, or 405. Such requests are used in exploitation attempts to reach vulnerable functionality that can lead to unauthorized administrative actions and command execution. It relies on HTTP method, requested URI query matching for the listed endpoints, and server response status telemetry from webserver logs.
references:
  - https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html
  - https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment
  - https://github.com/ForceFledgling/CVE-2023-22518
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-22518/web_exploit_cve_2023_22518_confluence_auth_bypass.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-11-14
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2023-22518
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: POST
  selection_uris:
    cs-uri-query|contains:
      - /json/setup-restore-local.action
      - /json/setup-restore-progress.action
      - /json/setup-restore.action
      - /server-info.action
      - /setup/setupadministrator.action
  selection_status:
    sc-status:
      - 200
      - 302
      - 405
  condition: all of selection_*
falsepositives:
  - Vulnerability scanners
level: medium
license: DRL-1.1