CVE-2023-22527 Atlassian Confluence Data Center and Server Template Injection
Unauthenticated attackers can achieve remote code execution via template injection in older Confluence versions, requiring immediate upgrades.
- Exploited in the wild
- Since 24 Jan 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-22527?
CVE-2023-22527 is a critical code injection vulnerability in Atlassian Confluence Data Center, published on 16 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.
Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.
Weakness: CWE-74
Which versions are affected by CVE-2023-22527?
It affects 2 products.
Products include Atlassian Confluence Data Center, Atlassian Confluence Server.
How do I fix CVE-2023-22527?
No fix has been published for CVE-2023-22527 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 14 Feb 2024.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-22527 being exploited?
Yes. Attackers have exploited CVE-2023-22527 in the wild since at least 24 Jan 2024, including in ransomware campaigns.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 23 proofs of concept on GitHub.
Other vulnerabilities in Atlassian Confluence Data Center
- CVE-2023-22518 Atlassian Confluence Data Center and Server Improper Authorization
- CVE-2023-22515 Atlassian Confluence Data Center and Server Broken Access Control
- CVE-2022-26134 Atlassian Confluence Server and Data Center Remote Code Execution
- CVE-2021-26084 Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection
- CVE-2021-26085 Atlassian Confluence Server Pre-Authorization Arbitrary File Read
Sources
Also known as GHSA-w64x-j9r3-q79q.