Conf. Data Center Workarounds for Vulnerability CVE-2023-22518

[Jay Moczulski]

Are data center instances with two factor authentication -global protect vpn not publically exposed - also at critical risk for this? 

[Kian Stack Mumo Systems]

@Jay Moczulski, you are at less risk due to the fact that your instance is not publicly accessible, but it still should be addressed as soon as possible.

[Leo Leung]

So are there any workarounds to patch CVE-2023-22518?

I'm running 7.19.1 and no longer have maintenance support. Can I still upgrade to the latest version 7.19.16 for this security fix?

[BHUSHAN PATIL]

Hi @Leo Leung / @Jay Moczulski  ,

Following is the temporary workarounds to mitigate CVE-2023-22518.

1. Back up your instance
   (Instructions: https://confluence.atlassian.com/doc/production-backup-strategy-38797389.html)
2. Remove your instance from the internet until you can patch, if possible. Instances accessible to the public internet, including those with user authentication, should be restricted from external network access until you can patch.
3. If you cannot restrict external network access or patch, apply the following interim measures to mitigate known attack vectors by blocking access on the following endpoints on Confluence instances:

a. /json/setup-restore.action

b. /json/setup-restore-local.action

c. /json/setup-restore-progress.action

This is possible at the network layer or by making the following changes to Confluence configuration files.

1. On each node, modify /<confluence-install-dir>/confluence/WEB-INF/web.xml and add the following block of code (just before the </web-app> tag at the end of the file):

<security-constraint>
 <web-resource-collection>
 <url-pattern>/json/setup-restore.action</url-pattern>
 <url-pattern>/json/setup-restore-local.action</url-pattern>
 <url-pattern>/json/setup-restore-progress.action</url-pattern>
 <http-method-omission>*</http-method-omission>
 </web-resource-collection>
 <auth-constraint />
</security-constraint>

2. Restart Confluence.

Note: These mitigation actions are limited and not a replacement for patching your instance; you must upgrade to following fixed versions as soon as possible.

Confluence Fixed Versions
7.19.16
8.3.4
8.4.4
8.5.3
8.6.1

Regards,
Bhushan