CVE-2024-23736

Executive Summary

CVE-2024-23736 is a Cross-Site Request Forgery (CSRF) vulnerability identified in the Savignano S/Notify plugin for Atlassian Confluence, affecting versions prior to 4.0.2. This flaw allows an attacker to trick an authenticated Confluence administrator into unknowingly performing actions that manipulate their S/MIME certificate or PGP key settings. By crafting a malicious link or email, the attacker can force the victim to change or upload a new certificate/key, potentially enabling the interception or decryption of encrypted communications within the Confluence instance. The vulnerability has a CVSS score of 0.0 (pending official assessment) and an EPSS score of 0.0%, indicating low exploitation activity at the time of analysis. No public proof-of-concept code or exploit templates are currently available.

Supply Chain & Package Security

This vulnerability affects a third-party plugin (S/Notify) for the Atlassian Confluence ecosystem. It is not a native Confluence vulnerability but a plugin-specific issue. Organizations using S/Notify should treat this as a critical supply chain risk, as the plugin handles sensitive cryptographic material (S/MIME certificates and PGP keys). The plugin is distributed via the Atlassian Marketplace and is not available through standard package managers (NPM, PyPI, Go, Ruby). Mitigation requires updating the plugin directly from the vendor.

CVSS Breakdown & Threat Level

The official CVSS score is listed as 0.0, which typically indicates an unassessed or reserved CVE. Based on the vulnerability characteristics, a reasonable estimated CVSS v3.1 vector would be:

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Estimated Base Score: 8.1 (High)

Breakdown:

• Attack Vector (AV): Network – The attack can be launched remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – The attacker does not need an account.
• User Interaction (UI): Required – The victim must click a link or open an email.
• Scope (S): Unchanged – The vulnerable component remains the same.
• Confidentiality (C): High – Manipulated certificates/keys can lead to decryption of sensitive data.
• Integrity (I): High – Attacker can replace legitimate keys with their own.
• Availability (A): None – No direct denial-of-service impact.

Threat Level: High. Although no active exploitation has been observed, the potential impact on encrypted communications makes this a priority for patching.

Deep Dive & Mechanics

The S/Notify plugin for Confluence provides S/MIME and PGP encryption capabilities for email notifications. It allows administrators to upload and manage certificates and keys used for signing and encrypting emails sent from Confluence.

The CSRF vulnerability exists because the plugin does not implement proper anti-CSRF tokens or origin validation on endpoints that handle certificate/key management. Specifically, the following actions are vulnerable:

• Uploading a new S/MIME certificate
• Uploading a new PGP key
• Deleting or modifying existing certificates/keys

An attacker can craft a malicious HTML page or email containing a form that automatically submits a request to the Confluence server. If an authenticated administrator visits the attacker-controlled page, the browser will send the request with the administrator's session cookies, causing the action to be performed without the administrator's consent.

Attack Flow:

1. Attacker identifies a Confluence instance with S/Notify < 4.0.2.
2. Attacker crafts a CSRF payload (e.g., an HTML form that POSTs to the certificate upload endpoint).
3. Attacker sends the payload via email or a link to an authenticated administrator.
4. Administrator clicks the link or opens the email, triggering the CSRF request.
5. The request is processed, and the attacker's malicious certificate/key is uploaded.
6. Attacker can now intercept or decrypt email notifications sent by Confluence.

Vulnerable vs. Patched Code

Vulnerable Code (S/Notify < 4.0.2): The plugin likely uses a servlet or action class that handles certificate uploads without CSRF protection. Example vulnerable pattern:

// Vulnerable: No CSRF token check
public void doPost(HttpServletRequest request, HttpServletResponse response) {
    String certificateData = request.getParameter("certificate");
    // Process and save certificate
    saveCertificate(certificateData);
}

Patched Code (S/Notify >= 4.0.2): The patched version introduces a CSRF token validation. Example:

// Patched: CSRF token validation
public void doPost(HttpServletRequest request, HttpServletResponse response) {
    String csrfToken = request.getParameter("csrf_token");
    if (!validateCsrfToken(csrfToken, request.getSession())) {
        response.sendError(HttpServletResponse.SC_FORBIDDEN, "Invalid CSRF token");
        return;
    }
    String certificateData = request.getParameter("certificate");
    saveCertificate(certificateData);
}

The exact patch details are not publicly available, but the vendor recommends upgrading to version 4.0.2.

Exploitation & Lab Setup

Red Team

Lab Environment:

• Atlassian Confluence (any supported version)
• S/Notify plugin version < 4.0.2
• Attacker machine with a web server to host the CSRF payload
• Victim browser with an active Confluence admin session

Exploitation Steps:

1. Identify Target: Use Shodan or manual reconnaissance to find Confluence instances with S/Notify. Example dork: http.title:"S/Notify".

2. Craft CSRF Payload: Create an HTML file that automatically submits a POST request to the certificate upload endpoint. The exact endpoint may vary; common paths include /plugins/servlet/snotify/certificate or /admin/snotify/uploadCertificate.action.

<html>
<body>
<form action="https://target-confluence.example.com/plugins/servlet/snotify/certificate" method="POST" enctype="multipart/form-data">
    <input type="file" name="certificate" value="-----BEGIN CERTIFICATE-----\nMIIBxTCCAS0CAQAwgY8xCzAJBgNVBAYTAlVT...\n-----END CERTIFICATE-----">
    <input type="submit" value="Submit">
</form>
<script>
    document.forms[0].submit();
</script>
</body>
</html>

3. Host Payload: Serve the HTML file from an attacker-controlled web server (e.g., python3 -m http.server 8080).

4. Deliver Payload: Send the link to the victim administrator via email or social engineering.

5. Execute: When the victim visits the link, the CSRF request is sent, and the attacker's certificate is uploaded.

6. Exploit: The attacker can now decrypt any email notifications encrypted with the compromised key.

Blue Team

Detection & Prevention:

• Network Monitoring: Monitor for unusual POST requests to S/Notify endpoints from external referrers.
• Log Analysis: Check Confluence access logs for requests to /plugins/servlet/snotify/* or /admin/snotify/* with suspicious user-agent strings or missing CSRF tokens.
• User Awareness: Train administrators to be cautious of unsolicited links and to verify the origin of any certificate management requests.
• Web Application Firewall (WAF): Deploy WAF rules to block requests to S/Notify endpoints that do not include a valid CSRF token or originate from unexpected domains.

Hunting Queries:

• Search for multiple certificate upload attempts from the same IP within a short time window.
• Look for requests to S/Notify endpoints with Referer headers not matching the Confluence domain.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /plugins/servlet/snotify/certificate or /admin/snotify/uploadCertificate.action with suspicious payloads.
  • Requests with Referer headers pointing to external domains.
• File IOCs:
  • Unexpected S/MIME certificates or PGP keys in the Confluence data directory (e.g., <confluence-home>/snotify/).
• Log IOCs:
  • Confluence access logs showing repeated POST requests to S/Notify endpoints from the same IP.
  • Audit logs showing certificate/key uploads without corresponding user-initiated actions.

Detection Engineering

YARA Rule

rule CVE_2024_23736_CSRF_Payload {
    meta:
        description = "Detects CSRF payloads targeting S/Notify for Confluence"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-23736"
    strings:
        $s1 = "snotify" nocase
        $s2 = "certificate" nocase
        $s3 = "uploadCertificate" nocase
        $s4 = "-----BEGIN CERTIFICATE-----"
        $s5 = "-----BEGIN PGP PRIVATE KEY BLOCK-----"
    condition:
        any of ($s1, $s2, $s3) and any of ($s4, $s5)
}

Sigma Rule

title: CVE-2024-23736 - S/Notify CSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential CSRF attacks against S/Notify plugin for Confluence
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: confluence
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains:
            - '/plugins/servlet/snotify/'
            - '/admin/snotify/'
        cs-referer|re: '^(?!https?:\/\/[^\/]*confluence[^\/]*).*$'
    condition: selection
falsepositives:
    - Legitimate cross-origin requests from trusted sources
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-23736 - S/Notify CSRF Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/plugins/servlet/snotify/"; http_uri; content:"/admin/snotify/"; http_uri; pcre:"/Referer:[^\r\n]*?(?!confluence)/Hi"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade S/Notify: Update to version 4.0.2 or later from the Atlassian Marketplace.
2. Verify Certificates: After patching, audit all uploaded S/MIME certificates and PGP keys for unauthorized entries.
3. Rotate Keys: If any unauthorized keys are found, revoke them and re-issue legitimate keys.

Long-Term Mitigations:

• Enable CSRF Protection: Ensure all Confluence plugins and custom applications implement anti-CSRF tokens.
• Implement SameSite Cookies: Configure Confluence to use SameSite=Strict or Lax for session cookies.
• Use Web Application Firewall: Deploy a WAF with rules to block CSRF-like requests.
• Regular Security Audits: Periodically review plugin configurations and user permissions.

Workarounds (if patching is not immediately possible):

• Restrict access to S/Notify admin pages to a limited set of IP addresses.
• Disable the certificate upload functionality temporarily by modifying the plugin's servlet mappings (not recommended for production).

Valters IT
Securing Digital Frontiers