Skip to content
attack.paths
Sign in
← RegistryDossier · 6 steps · 5 edges

Unpatched Confluence (CVE-2023-22515) → internal foothold

Internal Confluence instance reachable from the corporate VLAN. Trivial privilege-escalation CVE creates an admin user; webshell uploaded; pivot into AD service accounts.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: foothold on the corporate LAN. Confluence Server / DC reachable internally and not patched for the 2023 broken-access-control bug.

§ Steps

  1. 01
    Pivot to AD via captured credsLateral Movement
    T1550.002— Pass the Hash
  2. 02
    Identify vulnerable versionReconnaissance
    W-RECON-FINGERPRINT— Tech Stack Fingerprinting
  3. 03
    Upload malicious plugin → webshellPersistence
    W-WEBSHELL— Webshell Deployment
  4. 04
    Find Confluence on internal networkDiscovery
    N-NMAP-INTERNAL— Internal Nmap Sweep
  5. 05
    Dump LSASS for service accountCredential Access
    W-LSASS-PROCDUMP— LSASS via procdump / comsvcs.dll
  6. 06
    Create admin via /setup-* endpointInitial Access
    SAAS-ATLAS-CVE— Atlassian Confluence / Jira RCE

§ References

§ Frequently asked

What is the "Unpatched Confluence (CVE-2023-22515) → internal foothold" attack path?
Internal Confluence instance reachable from the corporate VLAN. Trivial privilege-escalation CVE creates an admin user; webshell uploaded; pivot into AD service accounts. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Pivot to AD via captured creds (T1550.002) — a lateral movement primitive. Assumed environment: foothold on the corporate LAN.
What is the final impact of this kill-chain?
The final step lands on Create admin via /setup-* endpoint (SAAS-ATLAS-CVE), which falls under Initial Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers