CVE-2023-22527

Atlassian Confluence Data Center and Server Template Injection Vulnerability

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

Yes

*KEV

Decision

Act

*SSVC

Descriptions

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.

Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

Resumen de vulnerabilidad. Una vulnerabilidad de inyección de plantilla en versiones anteriores de Confluence Data Center y Server permite que un atacante no autenticado logre RCE en una instancia afectada. Los clientes que utilicen una versión afectada deben tomar medidas inmediatas. Las versiones compatibles más recientes de Confluence Data Center y Server no se ven afectadas por esta vulnerabilidad, ya que finalmente se mitigó durante las actualizaciones periódicas de la versión. Sin embargo, Atlassian recomienda que los clientes tengan cuidado de instalar la última versión para proteger sus instancias de vulnerabilidades no críticas descritas en el Boletín de seguridad de enero de Atlassian. Consulte “What You Need to Do” para obtener instrucciones detalladas. {panel:bgColor=#deebff} Los sitios de Atlassian Cloud no se ven afectados por esta vulnerabilidad. Si se accede a su sitio de Confluence a través de un dominio atlassian.net, está alojado en Atlassian y no es vulnerable a este problema. {panel} Versiones afectadas ||Producto||Versiones afectadas|| |Centro de datos y servidor de Confluence| 8.0.x 8.1.x 8.2.x 8.3.x 8.4.x 8.5.0 8.5.1 8.5.2 8.5.3| Versiones fijas ||Producto||Versiones fijas|| |Centro de datos y servidor de Confluence|8.5.4 (LTS)| |Centro de datos de Confluence| 8.6.0 o posterior (solo centro de datos) 8.7.1 o posterior (solo centro de datos)| Qué debe hacer inmediatamente parchear a una versión fija Atlassian recomienda parchear cada una de sus instalaciones afectadas a la última versión. Las versiones fijas enumeradas ya no son las versiones más actualizadas y no protegen su instancia de otras vulnerabilidades no críticas, como se describe en el Boletín de seguridad de enero de Atlassian. ||Producto||Versiones fijas||Últimas versiones|| |Centro de datos y servidor de Confluence| 8.5.4 (LTS)| 8.5.5 (LTS) |Centro de datos de Confluence| 8.6.0 o posterior (solo centro de datos) 8.7.1 o posterior (solo centro de datos)| 8.6.3 o posterior (solo centro de datos) 8.7.2 o posterior (solo centro de datos) Para obtener detalles adicionales, consulte el aviso completo.

Atlassian Confluence versions 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, and 8.5.0 through 8.5.3 suffer from a remote code execution vulnerability.

Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.

*Credits: Petrus Viet

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Act

Exploitation

Active

Automatable

Yes

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2023-01-01 CVE Reserved
2024-01-16 CVE Published
2024-01-16 First Exploit
2024-01-24 Exploited in Wild
2024-02-14 KEV Due Date
2024-08-19 CVE Updated
2024-09-03 EPSS Updated

CWE

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CAPEC

References (25)

URL	Tag	Source
https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html
https://blog.projectdiscovery.io/atlassian-confluence-ssti-remote-code-execution

URL	Date	SRC
https://github.com/vulncheck-oss/cve-2023-22527	2024-07-15
https://github.com/RevoltSecurities/CVE-2023-22527	2024-01-23
https://github.com/yoryio/CVE-2023-22527	2024-03-15
https://github.com/Boogipop/CVE-2023-22527-Godzilla-MEMSHELL	2024-02-21
https://github.com/VNCERT-CC/CVE-2023-22527-confluence	2024-01-23
https://github.com/Manh130902/CVE-2023-22527-POC	2024-01-23
https://github.com/Chocapikk/CVE-2023-22527	2024-01-23
https://github.com/M0untainShley/CVE-2023-22527-MEMSHELL	2024-02-26
https://github.com/Vozec/CVE-2023-22527	2024-01-23
https://github.com/thanhlam-attt/CVE-2023-22527	2024-01-25
https://github.com/adminlove520/CVE-2023-22527	2024-01-25
https://github.com/Privia-Security/CVE-2023-22527	2024-01-25
https://github.com/C1ph3rX13/CVE-2023-22527	2024-01-23
https://github.com/Niuwoo/CVE-2023-22527	2024-01-24
https://github.com/Drun1baby/CVE-2023-22527	2024-01-22
https://github.com/Sudistark/patch-diff-CVE-2023-22527	2024-01-18
https://github.com/YongYe-Security/CVE-2023-22527	2024-02-02
https://github.com/cleverg0d/CVE-2023-22527	2024-01-22
https://github.com/MaanVader/CVE-2023-22527-POC	2024-01-25
http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html	2024-08-19
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22527.rb	2024-01-16

URL	Date	SRC

URL	Date	SRC
https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615	2024-07-03
https://jira.atlassian.com/browse/CONFSERVER-93833	2024-07-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Atlassian Search vendor "Atlassian"		Confluence Data Center Search vendor "Atlassian" for product "Confluence Data Center"				>= 8.0.0 < 8.5.4 Search vendor "Atlassian" for product "Confluence Data Center" and version " >= 8.0.0 < 8.5.4"		-		Affected
Atlassian Search vendor "Atlassian"		Confluence Data Center Search vendor "Atlassian" for product "Confluence Data Center"				8.7.0 Search vendor "Atlassian" for product "Confluence Data Center" and version "8.7.0"		-		Affected
Atlassian Search vendor "Atlassian"		Confluence Server Search vendor "Atlassian" for product "Confluence Server"				>= 8.0.0 < 8.5.4 Search vendor "Atlassian" for product "Confluence Server" and version " >= 8.0.0 < 8.5.4"		-		Affected