I need to fix CVE-2023-22518 on my confluence server

[Игорь Кувшинников]

I need to fix CVE-2023-22518 on my confluence server, but our license expired, and not compatible with recommended versions, 7.19.16 etc.
What I can do? 

[Ollie Guan]

Hi @Игорь Кувшинников ,

Apply temporary mitigations if unable to patch

1. Back up your instance. (Instructions: https://confluence.atlassian.com/doc/production-backup-strategy-38797389.html)
2. Remove your instance from the internet until you can apply the patch, if possible. Instances accessible to the public internet, including those with user authentication, should be restricted from external network access until you can patch.

https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html

[Игорь Кувшинников]

So? What does it mean? We can not work without internet.

[Ollie Guan]

3. If you cannot restrict external network access or patch, apply the following interim measures to mitigate known attack vectors by blocking access on the following endpoints on Confluence instances:
   1. /json/setup-restore.action
   2. /json/setup-restore-local.action
   3. /json/setup-restore-progress.action

1. This is possible at the network layer or by making the following changes to Confluence configuration files.
On each node, modify /<confluence-install-dir>/confluence/WEB-INF/web.xml and add the following block of code (just before the </web-app> tag at the end of the file):

<security-constraint>
  <web-resource-collection>
   <url-pattern>/json/setup-restore.action</url-pattern>
   <url-pattern>/json/setup-restore-local.action</url-pattern>
   <url-pattern>/json/setup-restore-progress.action</url-pattern>
   <http-method-omission>*</http-method-omission>
  </web-resource-collection>
 <auth-constraint />
</security-constraint>

2. Restart Confluence.

Note: These mitigation actions are limited and not a replacement for patching your instance; you must patch as soon as possible

[diwakar reddy]

Thanks for the solution, we have applied the same but still when it is giving the vulnerable warning, how can i check the patch is applied. Could you please suggest us. 

Thanks, Diwakar 

[Manjunath MP]

Hi Diwakar,

We are in the same situation here.

When I tried to apply this patch, we are getting below error message

2023-11-14 11:55:10,319 ERROR [Catalina-utility-1] [ContainerBase.[Standalone].[localhost].[/]] log For security constraints with URL pattern [/json/setup-restore.action] the HTTP methods [*] are uncovered.                                                              ││ 2023-11-14 11:55:10,324 ERROR [Catalina-utility-1] [ContainerBase.[Standalone].[localhost].[/]] log For security constraints with URL pattern [/json/setup-restore-progress.action] the HTTP methods [*] are uncovered.                                                     ││ 2023-11-14 11:55:10,324 ERROR [Catalina-utility-1] [ContainerBase.[Standalone].[localhost].[/]] log For security constraints with URL pattern [/json/setup-restore-local.action] the HTTP methods [*] are uncovered.  
 

Any idea on this please?