Table of Contents
  • Home
  • /
  • Blog
  • /
  • Update on CVE-2023-22527- Trend Micro Reports Stealthy Backdoor Targets Unpatched Confluence Servers
September 4, 2024
|
7m

Update on CVE-2023-22527- Trend Micro Reports Stealthy Backdoor Targets Unpatched Confluence Servers


Atlassian Confluence Fileless Backdoor Alert

On August 30, 2024, Trend Micro published a critical technical analysis unveiling attacks on outdated Atlassian Confluence versions affected by CVE-2023-22527. This vulnerability, assigned a CVSS score of 10, allows unauthenticated attackers to exploit a template injection flaw in older versions of Confluence Data Center and Server, enabling remote code execution (RCE) on affected instances.

Trend Micro researchers detailed a new attack vector leveraging this vulnerability to deploy a sophisticated memory-resident fileless backdoor known as the Godzilla webshell. This stealthy approach significantly elevates the threat level, as it enables attackers to maintain persistence while evading traditional detection methods. The discovery underscores the urgent need for organizations to patch their Confluence servers and implement advanced security measures to counter such evolving threats.

Summary of the Vulnerability

CVE-2023-22527 is a critical security flaw in Atlassian Confluence that poses a significant risk to organizations using affected versions of the software. Here's a detailed breakdown of the vulnerability:

  • CVE ID: CVE-2023-22527

  • Description: Template injection vulnerability in Atlassian Confluence Data Center and Server

  • CVSS Score: 10.0 (Critical)

  • CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

The vulnerability stems from improper handling of user-supplied input in certain template files, particularly in the /confluence/template/aui/text-inline.vm endpoint. This flaw allows an unauthenticated attacker to exploit a template injection vulnerability, potentially leading to remote code execution on the affected Confluence instance.

The root cause appears to be related to the $stack.findValue function, which directly processes input from the request's label parameter without adequate sanitization. This oversight enables attackers to break out of the getText function call and inject malicious Object-Graph Navigation Language (OGNL) expressions, opening the door for remote code execution.

Affected Versions

  • Confluence Data Center and Server 8.0.x

  • Confluence Data Center and Server 8.1.x

  • Confluence Data Center and Server 8.2.x

  • Confluence Data Center and Server 8.3.x

  • Confluence Data Center and Server 8.4.x

  • Confluence Data Center and Server 8.5.0 - 8.5.3

Organizations using these versions are strongly advised to update to the patched versions (8.5.4 or later) immediately to mitigate the risk.

Exploitation Process

Before delving into the exploitation process, it's crucial to understand the key components involved:

Object-Graph Navigation Language (OGNL) is an expression language utilized for manipulating Java objects. Widely employed in web applications for server-side template creation, OGNL has been associated with notable security vulnerabilities, particularly in frameworks like Apache Struts.

Template Injection vulnerabilities arise when user-supplied input is inadequately sanitized in template engines. This oversight allows attackers to inject and execute malicious code within the template processing context, potentially leading to severe security breaches.

The Godzilla Webshell is an advanced, Chinese-language in-memory backdoor developed by "BeichenDream." Designed to evade detection during red team operations, it employs Advanced Encryption Standard (AES) encryption for network communications, significantly complicating detection through conventional security measures.

Exploitation Process

Trend Micro's comprehensive analysis reveals a sophisticated, multi-stage attack process exploiting CVE-2023-22527. Here you see the short summary of the exploitation process.

Fig: Attack Chain 

Initial Access Vector The attacker initiates the exploit by targeting CVE-2023-22527, leveraging velocity.struts2.context to execute OGNL objects. This is achieved through a carefully crafted malicious request that exploits the template injection vulnerability in the Confluence server.

Fig: Malicious request

Payload Delivery Mechanism The attack progresses with the evaluation of JavaScript code via ScriptEngineManager. This code is responsible for loading a Base64-encoded payload, which resolves to an anonymous Java class named MemGodValueShell.

Fig: The MemGodValueShell function

Loader Deployment and Execution The MemGodValueShell class serves as a sophisticated loader. It employs Java reflection techniques to navigate the server's internal architecture, retrieve the StandardContext object, and prepare the environment for the subsequent deployment of the Godzilla webshell.

Godzilla Webshell Injection In this critical phase, the loader decodes and loads the Godzilla webshell (GodzillaValue class) directly into memory. This class, extending ValveBase, functions as a custom Tomcat valve, allowing it to intercept and process HTTP requests covertly.

Fig: Godzilla class

Persistence and Evasion Tactics The Godzilla webshell maintains its presence exclusively in memory, leaving no artifacts on the disk. This memory-resident approach, combined with AES encryption for all communications, significantly enhances its ability to evade detection through conventional network traffic analysis.

Command and Control Once established, the webshell enters a waiting state, anticipating encrypted commands from the attacker. Upon receipt, these commands are decrypted, and executed within the compromised environment, and the results are re-encrypted before transmission back to the attacker.

This meticulously engineered attack chain exemplifies the evolving sophistication of threat actors. By combining the exploitation of known vulnerabilities with advanced evasion techniques, attackers can compromise and maintain persistent access to Atlassian Confluence servers while minimizing the risk of detection. Please refer to the detailed technical analysis from the original post.

Mitigation Strategies

To safeguard Confluence servers against this sophisticated attack, organizations should adopt a multi-layered defense approach. Immediate patching to Confluence version 8.5.4 or later is crucial. Block IOCs. Implement network segmentation and deploy a Web Application Firewall (WAF) to filter malicious traffic. Conduct regular security audits and vulnerability assessments. Invest in advanced Endpoint Detection and Response (EDR) solutions capable of identifying fileless malware. Employ intrusion detection systems and analyze network traffic for suspicious patterns. Adhere to the principle of least privilege by restricting user permissions and removing unnecessary integrations. Maintain up-to-date, offline backups for rapid recovery in case of compromise. This comprehensive strategy combines proactive measures with robust detection and response capabilities.

Hunting Query

Hunting query if Atlassian Java executed commands:

(eventSubId:2 AND processCmd:atlassian AND parentCmd:atlassian AND parentCmd:java AND (objectName:*\\Windows\\System32\\* OR objectName:*bin/*))

Indicators of Compromise (IOC)

Hash
Detection
dfeccdc0c1d28f1afd64a7bb328754d07eead10c
TROJ_FRS.VSNTH724
2cb94ce0b147303b7beb91f034d0dc7fa734dbcb
Backdoor.JS.WEBSHELL.VSNW08H24

MITRE ATT&CK Techniques

Tactic
Technique
Technique ID
Initial Access
Exploit Public-Facing Application
T1190
Execution
Command and Scripting Interpreter: Unix Shell  
T1059.004
Defense Evasion
Obfuscated Files or Information: Encrypted/Encoded File
T1027.013
Reflective Code Loading
T1620
Obfuscated Files or Information: Embedded Payloads
T1027.009
Process Injection: Thread Execution Hijacking  
T1055.003
Deobfuscate/Decode Files or Information
T1140
Command and Control
Encrypted Channel: Symmetric Cryptography
T1573.001
Persistence
Server Software Component: Web Shell
T1505.003
Exfiltration
Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
T1048.001

MITRE D3FEND

Tactic
Technique
Technique ID
Defense Recommendations
Initial Access
Exploit Public-Facing Application
T1190
- Keep public-facing applications updated and patched<br>- Implement Web Application Firewall (WAF)<br>- Use network segmentation to isolate public-facing services
Execution
Command and Scripting Interpreter: Unix Shell
T1059.004
- Implement application control policies<br>- Monitor for unusual command-line activity<br>- Use endpoint detection and response (EDR) solutions
Defense Evasion
Obfuscated Files or Information: Encrypted/Encoded File
T1027.013
- Use advanced antivirus solutions with behavioral analysis<br>- Implement file integrity monitoring<br>- Employ network traffic analysis to detect suspicious encrypted communications
Defense Evasion
Reflective Code Loading
T1620
- Use memory analysis tools<br>- Implement behavior-based detection methods<br>- Monitor for unusual process memory allocations
Defense Evasion
Obfuscated Files or Information: Embedded Payloads
T1027.009
- Employ content disarm and reconstruction (CDR) technologies<br>- Use sandboxing for file analysis<br>- Implement deep file inspection techniques
Defense Evasion
Process Injection: Thread Execution Hijacking
T1055.003
- Use EDR solutions with process monitoring capabilities<br>- Implement behavior-based anomaly detection<br>- Monitor for unusual thread creation or modification
Defense Evasion
Deobfuscate/Decode Files or Information
T1140
- Implement robust logging and monitoring of file operations<br>- Use static and dynamic analysis tools<br>- Employ machine learning-based detection for unusual file transformations
Command and Control
Encrypted Channel: Symmetric Cryptography
T1573.001
- Implement SSL/TLS inspection<br>- Use network traffic analysis tools<br>- Monitor for unusual encryption patterns or volumes
Persistence
Server Software Component: Web Shell
T1505.003
- Regularly scan for unauthorized web shells<br>- Implement file integrity monitoring<br>- Use application whitelisting on servers
Exfiltration
Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
T1048.001
- Monitor for unusual outbound network connections<br>- Implement data loss prevention (DLP) solutions<br>- Use network segmentation to control data flow

We hope this post helps understand how attackers abusing the CVE-2023-22527 vulnerability to compromise unpatched Confluence Servers. Thanks for reading this post. Please share this post and help secure the digital world.Visit our website thesecmaster.com, and our social media page on FacebookLinkedInTwitterTelegramTumblrMedium, and Instagram and subscribe to receive updates like this.

You may also like these articles:

Arun KL

Arun KL is a cybersecurity professional with 15+ years of experience in IT infrastructure, cloud security, vulnerability management, Penetration Testing, security operations, and incident response. He is adept at designing and implementing robust security solutions to safeguard systems and data. Arun holds multiple industry certifications including CCNA, CCNA Security, RHCE, CEH, and AWS Security.

Recently added

Vulnerabilities

View All

Learn More About Cyber Security Security & Technology

“Knowledge Arsenal: Empowering Your Security Journey through Continuous Learning”

Cybersecurity All-in-One For Dummies - 1st Edition

"Cybersecurity All-in-One For Dummies" offers a comprehensive guide to securing personal and business digital assets from cyber threats, with actionable insights from industry experts.

Tools

Featured

View All

Learn Something New with Free Email subscription

Subscribe

Subscribe