Atlassian reveals critical Confluence RCE flaw, urges "immediate action" (CVE-2023-22527)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-22522 | This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See the advisory for additional details Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue. NVD description · AI analysis pending | 8.8 | 13% |
| — | ||
| CVE-2023-22527 | Unauthenticated OGNL Template Injection RCE in Atlassian Confluence Data Center/Server Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability (CWE-74) in which attacker-controlled input is evaluated by the application as an OGNL expression. A remote, unauthenticated attacker can trigger the flaw by sending a crafted HTTP request that injects OGNL expressions, which the server then executes. Successful exploitation leads to remote code execution on the host running Confluence, giving the attacker control of the system without any credentials. Any organization running self-hosted Confluence Data Center or Server is potentially affected — the available data does not specify version ranges, so operators should consult Atlassian's advisory — with internet-facing instances at highest risk. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-24 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days (100th percentile). Do: Patch to the fixed release specified in Atlassian's advisory immediately, prioritizing internet-exposed instances, since the flaw is in CISA's KEV with known ransomware use and carries a 100% EPSS. If patching is not immediately possible, apply the vendor's mitigations per the KEV required action — or discontinue/restrict use — for example by limiting unauthenticated access to Confluence from the internet. Review Confluence access and application logs for anomalous unauthenticated requests and indicators of command execution or ransomware activity. | 9.8 | 100% | KEV ransomware PoC ×2 |
| largetens of thousands of internet-exposed Confluence instances (order of 10,000–100,000) |
Full article573 words · extracted from helpnetsecurity.com · click to collapse
Atlassian has patched a critical vulnerability (CVE-2023-22527) in Confluence Data Center and Confluence Server that could lead to remote code execution.
The good news is that the flaw was fixed in early December 2023 with the release of versions 8.5.4 LTS (Data Center and Server) and 8.6.0 and 8.7.1 (only Data Center), so some customers have already upgraded to those or to later versions. The bad news is that some customers haven’t.
Atlassian hasn’t mentioned whether the vulnerability is being actively exploited, but has said that customers “must take immediate action to protect their Confluence instances.”
About CVE-2023-22527
CVE-2023-22527 is a template injection vulnerability that allows an unauthenticated attacker to achieve RCE on an affected version of Confluence Data Center and Confluence Server: 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, and 8.5.0-8.5.3. There is no available workaround.
“Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular updates,” the company noted today (i.e., more than a month after releasing those updates).
Atlassian Cloud instances are not affected by this vulnerability, and neither is Confluence version 7.19.x.
Additional advice for customers
Vulnerable Confluence instances have been preferred targets of various threat actors over the years.
“If the Confluence instance cannot be accessed from the internet the risk of exploitation is reduced, but not completely mitigated,” the company added, and again “strongly recommended” upgrading to the latest version available.
If updating is impossible at this time, customers should take their system off the internet immediately, back up the data of the instance to a secure location outside of the Confluence instance, and engage their local security team to review for any potential malicious activity.
Unfortunately, Atlassian did not share possible indicators of compromise, as “the possibility of multiple entry points, along with chained attacks, makes it difficult to list [them all].”
UPDATE (January 17, 2024, 04:05 a.m. ET):
An Atlassian spokesperson confirmed for Help Net Security that they don’t have evidence of an active exploit.
“This previously unknown vulnerability came to us via our bug bounty program after we issued CVE-2023-22522. When patching for CVE-2023-22522 we also updated our feature and long-term support (LTS) versions with some planned security maintenance, which ultimately mitigated this new critical vulnerability as well. As such, CVE-2023-22527 affects only out-of-date Confluence Data Center and Server versions released before Dec. 5, 2023 as well as 8.4.5 which no longer receives backported fixes in accordance with our Security Bug Fix Policy,” they explained.
“CVE-2023-22527 is classified as CVSS 10, the highest critical rating, and affected customers are vulnerable to a remote code execution (RCE) attack by an unauthenticated attacker via any number of entry points as indicated in the CVSS vector string. The complex nature of the potential exploit as well as a wide variety of possible post-exploit activities, makes it difficult to list all possible indicators of a compromise. Affected customers must immediately patch to the latest version as per our Critical Security Advisory.”
UPDATE (January 22, 2024, 05:20 a.m. ET):
The Shadowserver Foundation says they have been seeing exploitation attempts since Friday (January 19, 2024).
UPDATE (January 23, 2024, 10:10 a.m. ET):
Technical details about and proof-of-concept exploit code for CVE-2023-22527 have been released.
UPDATE (August 28, 2024, 02:55 a.m. ET):
The vulnerability is being exploited by cryptojackers.
UPDATE (May 22, 2025, 04:25 a.m. ET):
The vulnerability has been spotted being leveraged by ransomware threat actors.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/01/16/cve-2023-22527/