Just in Time Bulletin: CVE-2023-22527 Atlassian Confluence RCE

What is CVE-2023-22527? 

Atlassian recently reported an unauthenticated remote command execution vulnerability that impacts certain versions of Confluence Data Center and server. The vulnerability, assigned CVE-2023-22527, can be exploited remotely by an unauthenticated attacker. The root cause of the vulnerability is related to the way that views are rendered in Confluence. Confluence leverages velocity templates (*.vm) in this capacity and these files can be accessed directly like any other script, which effectively bypasses authentication. It was found that at least one of the accessible templates was prone to OGNL injection, which provided a reliable vector for remote command execution.

This is a critical vulnerability. Successful exploitation facilitates remote command execution, which can result in malware deployment or lateral movement within a private network.

How bad is this?

How is it exploited? 

Exploitation is carried out by an unauthenticated attacker via a POST request to a *.vm script using a crafted OGNL payload. Exploitation requires a single request and a low level of complexity.

How do I protect myself?

Atlassian recommends that vulnerable installations apply the patch that correlates to their version.

Who is affected by this? 

Current estimates based on Shodan and Censys queries indicate that roughly 5,600 endpoints across the internet are externally accessible.

Mitigating Factors?

There are no known workarounds. To remediate this vulnerability, update each affected product installation to the latest version.

Additional Resources About CVE-2023-22527

• https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html
• https://blog.projectdiscovery.io/atlassian-confluence-ssti-remote-code-execution/