From 69be7e2da96207c9bc9053aa5bb7b47c3a22ee10 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 13 Oct 2023 12:23:52 -0600
Subject: [PATCH] Create confluence_cve_2023_22515_trigger_vulnerability.yml

---
 ...e_cve_2023_22515_trigger_vulnerability.yml | 62 +++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml

diff --git a/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml b/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml
new file mode 100644
index 0000000000..50635e63aa
--- /dev/null
+++ b/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml
@@ -0,0 +1,62 @@
+name: Confluence CVE-2023-22515 Trigger Vulnerability
+id: 630ea8b2-2800-4f5d-9cbc-d65c567349b0
+version: 1
+date: '2023-10-12'
+author: Michael Haag, Splunk
+status: production
+type: TTP
+data_source: []
+description: The following analytic identifies potential exploitation attempts on a known vulnerability in Atlassian Confluence, targeting the /server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false* and /server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=0& URLs. By analyzing web logs within the Splunk 'Web' Data Model, it filters for successful accesses (HTTP status 200) to these vulnerable endpoints. Such behavior is crucial for a SOC to monitor, as it suggests attackers might be exploiting a privilege escalation flaw in Confluence. A true positive implies a possible unauthorized access or account creation with escalated privileges. Key details captured include user-agent, HTTP methods, URL length, and source and destination IPs. These insights aid SOCs in swiftly detecting and responding to threats, ensuring vulnerabilities are mitigated before substantial compromise.
+search: '| tstats count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Web where Web.url IN ("/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false*","/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=0&") Web.http_method=GET Web.status=200
+  by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
+  | `drop_dm_object_name("Web")`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` | `confluence_cve_2023_22515_trigger_vulnerability_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on Web traffic that include fields relavent for traffic into the `Web` datamodel.
+known_false_positives: False positives may be present with legitimate applications.
+  Attempt to filter by dest IP or use Asset groups to restrict to Confluence servers.
+references:
+- https://github.com/Chocapikk/CVE-2023-22515/blob/main/exploit.py
+- https://x.com/Shadowserver/status/1712378833536741430?s=20
+- https://github.com/j3seer/CVE-2023-22515-POC
+tags:
+  analytic_story:
+  -  Privilege Escalation Vulnerability Confluence Data Center and Server
+  asset_type: Web server
+  atomic_guid: []
+  confidence: 80
+  impact: 90
+  message: Potential exploitation attempts on a known vulnerability in Atlassian Confluence detected. The source IP is $src$ and the destination hostname is $dest$.
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 72
+  required_fields:
+  - _time
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - Web.http_user_agent
+  security_domain: network
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/confluence/confluence_vuln_trigger_cve-2023-22515.log
+    source: suricata
+    sourcetype: suricata