I need to fix CVE-2023-22518 on my confluence server

Игорь Кувшинников November 2, 2023

I need to fix CVE-2023-22518 on my confluence server, but our license expired, and not compatible with recommended versions, 7.19.16 etc.
What I can do? 

1 answer

0 votes
Ollie Guan
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
November 2, 2023

Hi @Игорь Кувшинников ,

Apply temporary mitigations if unable to patch

  1. Back up your instance. (Instructions: https://confluence.atlassian.com/doc/production-backup-strategy-38797389.html)
  2. Remove your instance from the internet until you can apply the patch, if possible. Instances accessible to the public internet, including those with user authentication, should be restricted from external network access until you can patch.

https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html

Игорь Кувшинников November 2, 2023

So? What does it mean? We can not work without internet.

Ollie Guan
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
November 2, 2023
  1. If you cannot restrict external network access or patch, apply the following interim measures to mitigate known attack vectors by blocking access on the following endpoints on Confluence instances:
    1. /json/setup-restore.action
    2. /json/setup-restore-local.action
    3. /json/setup-restore-progress.action

1. This is possible at the network layer or by making the following changes to Confluence configuration files.
On each node, modify /<confluence-install-dir>/confluence/WEB-INF/web.xml and add the following block of code (just before the </web-app> tag at the end of the file):

<security-constraint>
  <web-resource-collection>
   <url-pattern>/json/setup-restore.action</url-pattern>
   <url-pattern>/json/setup-restore-local.action</url-pattern>
   <url-pattern>/json/setup-restore-progress.action</url-pattern>
   <http-method-omission>*</http-method-omission>
  </web-resource-collection>
 <auth-constraint />
</security-constraint>


2. Restart Confluence.


Note: These mitigation actions are limited and not a replacement for patching your instance; you must patch as soon as possible

diwakar reddy
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
November 2, 2023

Thanks for the solution, we have applied the same but still when it is giving the vulnerable warning, how can i check the patch is applied. Could you please suggest us. 

 

Thanks, Diwakar 

Manjunath MP November 14, 2023

Hi Diwakar,

We are in the same situation here.

When I tried to apply this patch, we are getting below error message

2023-11-14 11:55:10,319 ERROR [Catalina-utility-1] [ContainerBase.[Standalone].[localhost].[/]] log For security constraints with URL pattern [/json/setup-restore.action] the HTTP methods [*] are uncovered.                                                              ││ 2023-11-14 11:55:10,324 ERROR [Catalina-utility-1] [ContainerBase.[Standalone].[localhost].[/]] log For security constraints with URL pattern [/json/setup-restore-progress.action] the HTTP methods [*] are uncovered.                                                     ││ 2023-11-14 11:55:10,324 ERROR [Catalina-utility-1] [ContainerBase.[Standalone].[localhost].[/]] log For security constraints with URL pattern [/json/setup-restore-local.action] the HTTP methods [*] are uncovered.  
 

Any idea on this please?

Suggest an answer

Log in or Sign up to answer
TAGS
AUG Leaders

Atlassian Community Events