How to confirm logs show no signs of exploitation for CVE-2023-22518

[acast2]

If a Confluence server is compromised the FAQ page shows examples of what to search for in the logs that could confirm it, but some of the items are not always matching up in regards to the keywords to use for search and what logs these show up in.

Is there a keyword to search for that if not found at all in any of the logs would confirm that it's not compromised?

[Dan Breyen · Accepted solution]

faq-for-cve-2023-22518-1311474094 

improper-authorization-vulnerability-in-confluence-data-center-and-server 

Hi @acast2 Based on those 2 articles I don't see anything like a keyword search to know if it's not compromised.  In my opinion, (for what it's worth) if it was my system, I would go through the mitigation process anyway.

Hope that helps.

[acast2]

After posting this, I received confirmation from Atlassian that if the keywords given within their documentation that you mentioned along with the FAQ then that means there is no attempt or confirmed exploit, so I went through logs from previous backups and confirmed that they were not compromised, so I got my answer.

As you said, I too agree about going through the mitigation process which is what I'm currently doing...thanks