Vulnerability Summary
-
CVE ID: CVE-2023-22527
-
Severity: Critical (CVSS 3.1 Score: 10.0)
-
Attack Vector: Network
-
Privileges Required: None
-
User Interaction: None
-
Impact: Remote Code Execution (RCE)
CVE-2023-22527 is a critical vulnerability in Atlassian Confluence Data Center and Server, allowing unauthenticated attackers to execute arbitrary code on affected instances. The flaw arises from an Object-Graph Navigation Language (OGNL) injection vulnerability in the Velocity template engine, specifically within the text-inline.vm file. This vulnerability enables attackers to inject malicious OGNL expressions, leading to remote code execution without requiring authentication.
Affected Products
The following versions of Confluence Data Center and Server are affected:
-
8.0.x
-
8.1.x
-
8.2.x
-
8.3.x
-
8.4.x
-
8.5.0 through 8.5.3
Confluence LTS version 7.19.x is not affected by this vulnerability.
No phone number, email, or personal info required.
How the Exploit Works
The vulnerability has been actively exploited in the wild. Attackers have leveraged it to deploy cryptomining malware, such as XMRig, by executing malicious scripts that download and run mining software on compromised servers. These scripts often disable security services, establish persistence through cron jobs, and attempt lateral movement by harvesting SSH credentials.
A proof-of-concept (PoC) exploit demonstrates how an attacker can send a crafted HTTP POST request to the vulnerable text-inline.vm endpoint, injecting OGNL expressions that execute arbitrary commands on the server.
Mitigation Recommendations
-
Immediate Patching: Upgrade Confluence Data Center and Server to the latest versions. Atlassian has released fixes in versions 8.5.4 (LTS), 8.6.0, 8.7.1, and later.
-
Isolate Vulnerable Instances: If immediate patching isn’t possible, restrict access to affected Confluence instances by removing them from public networks and limiting internal access.
-
Monitor for Indicators of Compromise (IOCs): Check for unusual processes, unauthorized cron jobs, and unexpected network activity that may indicate exploitation.
-
Review Atlassian’s Security Advisory: For detailed guidance, refer to Atlassian’s official advisory on CVE-2023-22527.
Conclusion
CVE-2023-22527 poses a severe risk to organizations using vulnerable versions of Atlassian Confluence Data Center and Server. Given the ease of exploitation and the potential for significant impact, it’s imperative to apply the recommended patches promptly and implement additional security measures to protect your systems.
References