Huntress Details Confluence CVE-2023-22518 Exploitation Leading to Cerber Ransomware
Summary
Huntress reports active exploitation of Confluence CVE-2023-22518 by Nov. 3, 2023, followed by PowerShell-delivered Cerber ransomware. It explains the vulnerable restore endpoint and recommends patching, reducing exposure, and defense in depth.
Key points
- Atlassian disclosed the authorization vulnerability and released patches on October 31, 2023; Huntress observed active exploitation beginning November 3.
- An encoded PowerShell command downloaded and executed a remote script, which retrieved a payload and saved it as svcPrvinit.exe.
- Huntress identified the payload as a Cerber variant that appends L0CK3D to encrypted files.
- The exploit abuses the /json/setup-restore.action endpoint, which lacks WebSudo protection in affected versions, to restore a crafted site backup and create an administrator account.
- With administrative access, attackers could install a web shell, access Confluence data, or deploy ransomware.
- Huntress recommends promptly patching exposed Confluence systems, limiting direct internet access, and maintaining layered detection and response capabilities.
Article Details
- Attack Vectors
- Attackers exploited CVE-2023-22518 in Confluence Data Center and Confluence Server through a POST request to /json/setup-restore.action, using a crafted backup restore to create an administrator account.
- An encoded PowerShell command downloaded and executed a remote script from 193.176.179[.]41, which retrieved a hex-encoded executable and saved it as %TEMP%\svcPrvinit.exe.
- The executable was launched hidden with the argument "-b 9" and was identified as Cerber ransomware.
- Defensive Notes
- Patch externally exposed Confluence instances promptly; the article reports active exploitation beginning only days after patches were released.
- Identify externally exposed applications and reduce direct internet access where possible; place services requiring external access behind maintained security controls such as a VPN.
- Maintain defense-in-depth detection for post-exploitation activity, including encoded PowerShell and suspicious payload downloads.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 193[.]176[.]179[.]41 | IP address hosting the reported PowerShell script and hex-encoded ransomware payload. |
| SHA256 | f2e17ec85c3f8ee26a3be3ce52c6e140448941d705a9bdedb7c1aa82a9d9707f | SHA-256 hash of the PE file identified by Huntress as a Cerber ransomware variant. |
| URL | hxxp[:]//193[.]176[.]179[.]41/tmp.37 | Payload-delivery URL contacted by the encoded PowerShell command to download and execute a script. |
| URL | hxxp[:]//193[.]176[.]179[.]41/tmp.37.txt | Payload-delivery URL used by the downloaded script to retrieve the ransomware executable as raw hex. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe initial PowerShell command was encoded, and the executable payload was delivered as space-separated hexadecimal data.T1059.001 · PowerShellAn encoded PowerShell command downloaded and executed a remote script.T1105 · Ingress Tool TransferThe PowerShell script retrieved a remote payload and wrote it locally as svcPrvinit.exe.T1190 · Exploit Public-Facing ApplicationAttackers exploited the externally accessible Confluence vulnerability CVE-2023-22518.T1569.002 · Service ExecutionThe script launched the downloaded executable as a process using Start-Process.
CVE
People
Malware
Vendors
Products
Confluence Data Centerpatches and an advisory for CVE-2023-22518, an improper authorization vulnerability affecting Confluence Data Center and Confluence Server. Later, on November 3, 2023, additional information was released fromConfluence Serverfor CVE-2023-22518, an improper authorization vulnerability affecting Confluence Data Center and Confluence Server. Later, on November 3, 2023, additional information was released from Atlassian identifying