Atlassian CVE-2023-22527 Cryptojacking Full-Scale Exploitation

CVE-2023-22527, a critical vulnerability found in Atlassian with a severity score of 10, is actively exploited for cryptojacking, transforming affected environments into cryptomining networks. Attackers employ techniques such as shell scripts, XMRig miners, targeting SSH endpoints, killing competing cryptomining processes, and establishing persistence through cron jobs. Organizations are urged to update their Confluence instances and adopt robust security practices.

Vulnerability Overview

On January 16, 2024, Atlassian disclosed [CVE-2023-22527]https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html), a critical vulnerability affecting Confluence Data Center and Server versions from 8.0.x through 8.5.3. This vulnerability, related to template injection, allows unauthenticated remote code execution (RCE), posing significant security risks.

Affected Versions:

Product	Affected Versions
Confluence Data Center	8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, 8.5.0-8.5.3
Confluence Server	8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, 8.5.0-8.5.3

Exploitation Analysis

1. Attack Chain Overview

Exploitation of CVE-2023-22527 involves leveraging a template injection vulnerability for remote code execution.

2. Attack Methods

First Threat Actor: Utilizes XMRig miner via an ELF file payload. This attack vector demonstrates:

Deployment of cryptomining software.
Execution of mining commands.

*Malicious request from the first threat actor*

Second Threat Actor: Implements a shell script executed via SSH across accessible endpoints, including:

Killing known cryptomining processes.
Deleting cron jobs and adding new ones to maintain persistence.
Uninstalling security services.
Brute-forcing SSH to spread cryptomining scripts.

*Malicious request from the second threat actor*

Shell Script Behavior:

Process Termination: Kills cryptomining processes and those from `/tmp/` directories.
Cron Jobs: Deletes existing jobs and schedules new ones every five minutes.
Security Service Uninstallation: Targets security services like Alibaba Cloud Shield.
Data Collection: Gathers user credentials and IP addresses for further attacks.

*Detailed analysis of script functions and impacts*

3. Cryptojacking Automation

Script Execution: After initial exploitation, the script:

Executes mining activities.
Uses the `solr.sh` function to terminate security tools and mining processes.
Clears logs and bash history to remove traces.

Recommendations

Organizations should:

Update Software: Apply the latest patches for Confluence Data Center and Server.
Patch Management: Regularly update and patch all software to prevent exploitation.
Network Segmentation: Isolate critical network segments to mitigate impact.
Security Audits: Conduct regular security audits to identify and address vulnerabilities.
Incident Response Plan: Develop and test an incident response plan for effective breach management.

Additional Solutions:

Network-Based Controls: Implement network access controls.
Intrusion Prevention Systems: Use systems like Trend Vision One™.
Regular Scans: Perform vulnerability scans to detect threats.

Threat Hunting Queries

1. SSH Lateral Movement:

eventSubId: 2 AND processCmd:ssh AND processCmd:oStrictHostKeyChecking AND processCmd:oBatchMode

2. Malicious Cron Activities:

eventSubId: 2 AND (processCmd:cron OR objectCmd:cron) AND (processCmd:echo OR objectCmd:echo)

Indicators of Compromise

Detailed indicators of compromise are available here.

MITRE ATT&CK Mapping

Tactic	Technique	Technique ID
Initial Access	Exploit Public-Facing Application	T1190
Execution	Command and Scripting Interpreter: Unix Shell	T1059.004
Defense Evasion	Disable or Modify Tools	T1562.001
	Clear Command History	T1070.003
	Clear Linux or Mac System Logs	T1070.002
Command and Control	Ingress Tool Transfer	T1105
Persistence