CVE-2023-22515: Atlassian Confluence Broken Access Control Zero-Day Explained and Fixed

Confluence's initial setup wizard runs during first-time installation to configure the database connection and create the first administrator account. After setup completes, this wizard endpoint is supposed to be inaccessible. In affected versions (8.0.0 through 8.5.1), the access control check preventing post-setup access to the setup endpoint is missing or insufficiently enforced — the endpoint remains reachable from the internet on fully configured production instances.

An attacker sends a single HTTP POST request to the Confluence setup endpoint with parameters defining a new administrator account: username, password, email address, and display name. Confluence processes the request as if it were initial setup and creates the account with full Confluence administrator privileges. The attacker then logs in immediately with the newly created account. No prior knowledge of the Confluence instance, no existing credentials, and no complex exploit chain are required — just a POST request with account creation parameters.

Microsoft Threat Intelligence published attribution data October 13, 2023, identifying Storm-0062 (also tracked as ZINC, DarkShadow, and Oro0lxy) as the threat actor exploiting CVE-2023-22515. Microsoft observed Storm-0062 actively exploiting the vulnerability beginning September 14, 2023 — 19 days before Atlassian's advisory. The pre-advisory exploitation suggests Storm-0062 discovered the vulnerability independently or obtained information about it before responsible disclosure reached Atlassian.

Storm-0062 is a Chinese state-sponsored group with a history of targeting technology companies, defense contractors, and government entities for intellectual property theft and strategic intelligence collection. Their choice of Confluence as a target aligns with their interest in internal documentation and technical knowledge — Confluence instances often contain exactly the kind of architectural, strategic, and operational information that intelligence-gathering operations value.

Apply Atlassian's patches immediately. If unauthorized admin accounts exist in your Confluence instance, treat it as a confirmed compromise and initiate incident response.

CVE-2023-22515 is the third maximum-severity Confluence vulnerability in two years — following CVE-2021-26084 (OGNL injection, CVSS 9.8, August 2021) and CVE-2022-26134 (OGNL injection, CVSS 10.0, June 2022 zero-day). The repetition of critical vulnerabilities in the same product, exploited by nation-state actors before patches are available, should fundamentally inform how organizations classify and manage Confluence's risk profile.

Confluence is not a low-risk internal wiki. It is a high-value intelligence collection target containing exactly the information nation-state actors seek: architectural documentation, operational procedures, credential repositories, and strategic plans. It should receive the same patching urgency, network segmentation, and access monitoring as production databases. The three-week pre-patch exploitation window demonstrates that for Atlassian Confluence specifically, patching cadences measured in weeks are operationally inadequate — the response to a critical Confluence advisory must be measured in hours.