CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server

• Confluence Data Center and Server Privilege Escalation :
  network Web Server None version:11
  The following analytic identifies potential exploitation attempts on a known vulnerability in Atlassian Confluence, specifically targeting the /setup/*.action* URL pattern. It leverages web logs within the Splunk 'Web' Data Model, filtering for successful accesses (HTTP status 200) to these endpoints. This activity is significant as it suggests attackers might be exploiting a privilege escalation flaw in Confluence. If confirmed malicious, it could result in unauthorized access or account creation with escalated privileges, leading to potential data breaches or further exploitation within the environment.


• Confluence CVE-2023-22515 Trigger Vulnerability :
  network Web Server None version:10
  The following analytic identifies potential exploitation attempts of the Confluence CVE-2023-22515 vulnerability. It detects successful accesses (HTTP status 200) to specific vulnerable endpoints by analyzing web logs within the Splunk 'Web' Data Model. This activity is significant for a SOC as it indicates possible privilege escalation attempts in Confluence. If confirmed malicious, attackers could gain unauthorized access or create accounts with escalated privileges, leading to potential data breaches or further exploitation within the environment.


• Windows Unusual File Creation in Confluence Directory :
  endpoint Endpoint None version:3
  The following analytic detects executable file formats being created within the Confluence main directory. This can be indicative of exploitation of the Confluence web services to stage malware. This won't catch adversaries who modify the output location outside the Confluence directory when exploiting.


• Web Remote ShellServlet Access :
  network Web Server None version:11
  The following analytic identifies attempts to access the Remote ShellServlet on a web server, specifically targeting Confluence servers vulnerable to CVE-2023-22518 and CVE-2023-22515. It leverages web data to detect URLs containing "*plugins/servlet/com.jsos.shell/*" with a status code of 200. This activity is significant as it is commonly associated with web shells and other malicious behaviors, potentially leading to unauthorized command execution. If confirmed malicious, attackers could gain remote code execution capabilities, compromising the server and potentially the entire network.