Alert: ‘Effluence’ Backdoor Persists Despite Patching Atlassian Confluence Servers

Cybersecurity researchers have found out a stealthy backdoor named Effluence which is deployed adhering to the prosperous exploitation of a not long ago disclosed security flaw in Atlassian Confluence Details Heart and Server.

“The malware functions as a persistent backdoor and is not remediated by applying patches to Confluence,” Aon’s Stroz Friedberg Incident Reaction Solutions mentioned in an assessment published before this week.

“The backdoor offers capacity for lateral motion to other network resources in addition to exfiltration of knowledge from Confluence. Importantly, attackers can access the backdoor remotely with out authenticating to Confluence.”

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The attack chain documented by the cybersecurity entity entailed the exploitation of CVE-2023-22515 (CVSS rating: 10.), a critical bug in Atlassian that could be abused to make unauthorized Confluence administrator accounts and obtain Confluence servers.

Atlassian has considering the fact that disclosed a next flaw recognised as CVE-2023-22518 (CVSS score: 10.) that an attacker can also consider edge of to established up a rogue administrator account, ensuing in a total decline of confidentiality, integrity, and availability.

What would make the newest attack stand out is that the adversary attained preliminary entry via CVE-2023-22515 and embedded a novel web shell that grants persistent distant entry to every single web page on the server, like the unauthenticated login website page, without having the need to have for a valid person account.

The web shell, manufactured up of a loader and payload, is passive, enabling requests to pass by it unnoticed until a ask for matching a distinct parameter is presented, at which issue it triggers its destructive actions by executing a collection of steps.

This contains generating a new admin account, purging logs to cover up the forensic trail, working arbitrary commands on the underlying server, enumerating, reading through, and deleting documents, and compiling substantial details about the Atlassian atmosphere.

The loader component, for each Aon, acts as a normal Confluence plugin and is liable for decrypting and launching the payload.

“A number of of the web shell features count on Confluence-specific APIs,” security researcher Zachary Reichert said.

“On the other hand, the plugin and the loader system show up to rely only on prevalent Atlassian APIs and are most likely relevant to JIRA, Bitbucket, or other Atlassian products and solutions the place an attacker can install the plugin.”

Discovered this short article appealing? Observe us on Twitter  and LinkedIn to read through far more exclusive content material we post.