# Confluence to Cerber: Exploitation of ​​CVE-2023-22518

Improper authorization in Confluence's /json/setup-restore.action lets unauthenticated attackers upload a malicious backup zip, create an admin user, and deploy ransomware.

- Payout: Real-world hack
- Severity: critical
- Program: Atlassian Confluence
- Credited: Huntress
- Disclosed: 2023-11-07
- CVE: CVE-2023-22518
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment
- Tags: domain:web impact:funds-loss impact:rce kind:incident platform:threat-intel sev:critical tech:java technique:chained vuln:auth-bypass vuln:file-upload vuln:rce

**Target:** Confluence Data Center/Server REST endpoint /json/setup-restore.action
**Root cause:** The setup-restore endpoint lacks WebSudo authentication protection in affected versions, allowing unauthenticated access to site backup restore functionality.
**Steps:**
1. Send `POST /json/setup-restore.action` with header `X-Atlassian-Token: no-check`
2. Submit form fields required to upload and restore a full site backup zip
3. Replace empty zip with a malicious backup containing an injected admin user
4. Log in as the new admin and install the atlassian-webshell-plugin for RCE
5. Deploy payload: encoded PowerShell downloads `hXXp://193.176.179[.]41/tmp.37`, which fetches hex payload `tmp.37.txt`, writes `%TEMP%\svcPrvinit.exe`, runs it with `-b 9`
**How found:** Huntress detected an encoded PowerShell command downloading a remote payload via existing detections, then analyzed tmp.37 to trace the downloader and PE payload.
**Exploitation:** Unauthenticated attacker POSTs a weaponized backup zip to setup-restore.action, restores it to create an admin account, installs a web shell plugin, then executes encoded PowerShell to download and run a Cerber ransomware binary that encrypts files with L0CK3D extension.
**Escalation:** Admin account creation chained to web shell plugin installation enabling remote code execution and ransomware deployment.
**Insight:** Administrative restore/import endpoints that skip WebSudo are a recurring auth-bypass pattern in Atlassian products; check setup-* and restore actions for missing re-auth even when other admin paths enforce it.