Proxy HTTP POST to Confluence Setup and Admin JSON Endpoints (CVE-2023-22518)

title: Proxy HTTP POST to Confluence Setup and Admin JSON Endpoints (CVE-2023-22518)
id: e81ea2eb-25ea-4de1-8733-197427b8c615
related:
  - id: a902d249-9b9c-4dc4-8fd0-fbe528ef965c
    type: similar
  - id: 27d2cdde-9778-490e-91ec-9bd0be6e8cc6
    type: derived
status: test
description: This rule identifies proxy HTTP traffic using POST requests to specific Confluence setup and administration-related endpoints that are associated with CVE-2023-22518. Attackers may target these endpoints to achieve unauthorized actions such as creating administrative accounts and triggering command execution attempts. The detection relies on proxy telemetry that records HTTP method (POST), requested URI substrings, and observed response status codes (200, 302, or 405).
references:
  - https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html
  - https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment
  - https://github.com/ForceFledgling/CVE-2023-22518
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-22518/proxy_exploit_cve_2023_22518_confluence_auth_bypass.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-11-14
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2023-22518
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection_method:
    cs-method: POST
  selection_uris:
    cs-uri|contains:
      - /json/setup-restore-local.action
      - /json/setup-restore-progress.action
      - /json/setup-restore.action
      - /server-info.action
      - /setup/setupadministrator.action
  selection_status:
    sc-status:
      - 200
      - 302
      - 405
  condition: all of selection_*
falsepositives:
  - Vulnerability scanners
level: medium
license: DRL-1.1