Microsoft Warns of Nation-State Hackers Exploiting Critical Atlassian Confluence Vulnerability

Microsoft has connected the exploitation of a not too long ago disclosed critical flaw in Atlassian Confluence Facts Heart and Server to a country-point out actor it tracks as Storm-0062 (aka DarkShadow or Oro0lxy).

The tech giant’s risk intelligence team said it observed in-the-wild abuse of the vulnerability considering that September 14, 2023.

“CVE-2023-22515 is a critical privilege escalation vulnerability in Atlassian Confluence Information Middle and Server,” the enterprise famous in a sequence of posts on X (formerly Twitter).

“Any product with a network link to a vulnerable application can exploit CVE-2023-22515 to make a Confluence administrator account inside of the software.”

CVE-2023-22515, rated 10. on the CVSS severity score procedure, enables distant attackers to generate unauthorized Confluence administrator accounts and accessibility Confluence servers. The flaw has been addressed in the subsequent versions –

• 8.3.3 or later on
• 8.4.3 or later, and
• 8.5.2 (Long Expression Assist launch) or later

While the correct scale of the attacks is not clear, Atlassian claimed that it was designed aware of the issue by “a handful of prospects,” that means it had been exploited as a zero-day by the risk actor.

It is really value noting that Oro0lxy refers to a digital alias designed by Li Xiaoyu, a Chinese hacker who was accused by the U.S. Office of Justice (DoJ) in July 2020 of infiltrating “hundreds of organizations” in the U.S., Hong Kong, and China, together with coronavirus vaccine exploration developer Moderna.

Xiaoyu is reported to have been assigned to the Guangdong regional division of the Ministry of Condition Security (MSS).

“The defendants in some cases acted for their own personal money obtain, and in many others for the advantage of the MSS or other Chinese governing administration companies,” the DoJ stated. “The hackers stole terabytes of details which comprised a advanced and prolific risk to U.S. networks.”

Companies relying on Confluence applications are really proposed to update to the most recent versions to mitigate any likely threats, and also isolate them from the public internet till the fixes are in spot.

Observed this article appealing? Stick to us on Twitter  and LinkedIn to study far more exclusive information we publish.

Some parts of this article are sourced from:
thehackernews.com