HTTP POST exploitation attempt against Confluence CVE-2023-22518 vulnerable setup endpoints (Proxy logs)
Flags proxy POST requests to known Confluence setup/admin endpoints returning 200/302/405, aligned with CVE-2023-22518 exploitation attempts.
- Category
- proxy
- Author
- Andreas Braathen (mnemonic.io) (SigmaHQ), DRL 1.1
- Published
- 2023-11-14
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags HTTP POST requests over proxy logs targeting Confluence endpoints associated with CVE-2023-22518, including setup/restore and administrator setup paths. Attackers can abuse improper authorization to carry out actions such as creating administrative accounts and executing commands, so monitoring these specific requests helps catch exploitation attempts. The detection relies on proxy telemetry containing request method (POST), URI substring matches for the listed endpoints, and response status codes of 200, 302, or 405.
Reporting behind it
- confluence.atlassian.comhttps://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html
- huntress.comhttps://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment
- github.comhttps://github.com/ForceFledgling/CVE-2023-22518
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-22518/proxy_exploit_cve_2023_22518_confluence_auth_bypass.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: HTTP POST exploitation attempt against Confluence CVE-2023-22518 vulnerable setup endpoints (Proxy logs)
id: e81ea2eb-25ea-4de1-8733-197427b8c615
related:
- id: a902d249-9b9c-4dc4-8fd0-fbe528ef965c
type: similar
- id: 27d2cdde-9778-490e-91ec-9bd0be6e8cc6
type: derived
status: test
description: This rule flags HTTP POST requests over proxy logs targeting Confluence endpoints associated with CVE-2023-22518, including setup/restore and administrator setup paths. Attackers can abuse improper authorization to carry out actions such as creating administrative accounts and executing commands, so monitoring these specific requests helps catch exploitation attempts. The detection relies on proxy telemetry containing request method (POST), URI substring matches for the listed endpoints, and response status codes of 200, 302, or 405.
references:
- https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html
- https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment
- https://github.com/ForceFledgling/CVE-2023-22518
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-22518/proxy_exploit_cve_2023_22518_confluence_auth_bypass.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-11-14
tags:
- attack.initial-access
- attack.t1190
- cve.2023-22518
- detection.emerging-threats
logsource:
category: proxy
detection:
selection_method:
cs-method: POST
selection_uris:
cs-uri|contains:
- /json/setup-restore-local.action
- /json/setup-restore-progress.action
- /json/setup-restore.action
- /server-info.action
- /setup/setupadministrator.action
selection_status:
sc-status:
- 200
- 302
- 405
condition: all of selection_*
falsepositives:
- Vulnerability scanners
level: medium
license: DRL-1.1