cscli scenarios install crowdsecurity/CVE-2023-22515On October 4, 2023, Atlassian published a security advisory on CVE-2023-22515, a critical privilege escalation vulnerability affecting on-premises instances of Confluence Server and Confluence Data Center. Atlassian does not specify the root cause of the vulnerability or where exactly the flaw resides in Confluence implementations, though the indicators of compromise include mention of the /setup/* endpoints.
1## CVE-2023-225152type: trigger3name: crowdsecurity/CVE-2023-225154description: "Detect CVE-2023-22515 exploitation"5filter: |6 Lower(evt.Parsed.file_ext) == '.action' &&7 (Lower(evt.Parsed.file_dir) contains '/setup' || Lower(evt.Parsed.file_frag) == 'server-info') &&8 evt.Parsed.file_frag != nil9blackhole: 1m10groupby: "evt.Meta.source_ip"11labels:12 type: exploit13 remediation: true14 classification:15 - attack.T159516 - attack.T119017 - cve.CVE-2023-2251518 spoofable: 019 confidence: 120 behavior: "http:exploit"21 label: "Confluence CVE-2023-22515"22 service: confluence