CVE-2023-22527

Atlassian Confluence Data Center and Server: Template Injection

As of , CVE-2023-22527 in Atlassian Confluence Data Center and Server is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 24 January 2024
US federal deadline
14 February 202421 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Known
EPSS score
0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.00 on 24 January 2024EPSS on the day CISA listed it.
Public exploit
1 Metasploit module
Fix
Vendor advice: confluence.atlassian.comLinks below, from CISA's entry.

What CISA says to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA's required action

What the flaw is

Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.

CISA's description

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

The CVE record's description, from atlassian

CVE published
16 January 2024
Assigned by
atlassian
CVSS
10.0 Critical (CVSS 3.0, from the CNA)
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

  • Metasploit: Atlassian Confluence SSTI Injectionexploit module, rank excellent

Confluence Data Center and Server: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2023-22518Improper AuthorizationAtlassian Confluence Data Center and ServerPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
CVE-2023-22515Broken Access ControlAtlassian Confluence Data Center and ServerPatch this weekRansomware use; Metasploit module; EPSS 0.990.99

Read further