Point hosts at Confluence and flag CVE-2023-22518 by version, then confirm with an unauthenticated GET of /json/setup-restore.action. Non-destructive. CISA KEV.
Hosts, IPs, or URLs, one per line. Empty input uses localhost.
Detect
Fingerprints Confluence and flags CVE-2023-22518 by version. No probe.
Confirm
Unauthenticated GET of /json/setup-restore.action. No restore POST. Advisory
Collect
Merges per-host detect and confirm rows.
Report
Counts checked, product, affected, and confirmed.
Overview
This workflow finds Atlassian Confluence and sorts each host by whether its version falls below the CVE-2023-22518 floors. CVE-2023-22518 is unauthenticated access to the setup-restore action, which can reset the instance. This workflow never POSTs a restore. CISA listed it on KEV after confirmed use. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the public login page, reads the version, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. Version flag is first. Hosts in range get a second node that runs an unauthenticated GET of /json/setup-restore.action.
Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
Fingerprint each host as Confluence from /login.action, then read the version and compare it to the CVE-2023-22518 floors in the graph.
Confirm only those flagged hosts with an unauthenticated GET of /json/setup-restore.action.
Collect the per-host rows: product match, version, affected flag, confirmed flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, affected, confirmed, and errors.
Inputs
Target list. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a url field also works. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether Confluence was detected, the version read, the affected flag, and whether confirm succeeded.
summary.json. Counts across the list: targets, product hits, affected, confirmed, and errors.
Integrations
HTTP. Unauthenticated GET to the product login page and, on flagged hosts only, /json/setup-restore.action.
Sample output
The records below are illustrative and do not come from a real run. They show one Confluence host inside the CVE-2023-22518 range, one patched host, and one host that is not the product.
Every build before the vendor floors: 7.19.16, 8.3.4, 8.4.4, 8.5.3, and 8.6.1. Those releases and later are the versions the graph treats as not affected. The compare uses the version the product itself served.
Does a flagged host mean CVE-2023-22518 was exploited?
A flagged row is patch-lag against the range table. Confirm only an unauthenticated GET of /json/setup-restore.action. Treat a confirmed row as evidence the surface still answers, not as proof someone already used it.
Is this check safe on production?
Yes. Fingerprint is read-only GET. Confirm is an unauthenticated GET of /json/setup-restore.action, only on hosts already in range. It does not log in, write files, or POST a restore.
Does the check need credentials?
No. It fingerprints the public login page the way an external scanner would.
What is CVE-2023-22518?
Unauthenticated access to the setup-restore action, which can reset the instance. This workflow never POSTs a restore. This workflow flags by version then confirms with a non-intrusive request.