Loading vulnerability…
Unauthenticated Template Injection RCE in Atlassian Confluence
CVE-2023-22527 is a template-injection vulnerability in outdated Atlassian Confluence Data Center and Confluence Server releases, including 8.0.x through 8.4.x and 8.5.0 through 8.5.3. Improper handling of attacker-controlled template input permits OGNL expression evaluation through the Struts context. A remote, unauthenticated attacker can submit a specially crafted HTTP POST request to execute arbitrary Java code and operating-system commands. The vulnerability has been actively exploited to deploy cryptocurrency miners, Sliver implants, and in-memory Godzilla webshells.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the affected Confluence application and permits arbitrary code execution with the privileges of its service account. Attackers can access or modify application data and accessible credentials, deploy backdoors, and consume server resources through unauthorized cryptocurrency mining. Observed post-exploitation activity includes credential access, persistence, internal reconnaissance, and lateral-movement attempts. Elevated operating-system privileges depend on the service configuration or additional exploitation; they are not inherently granted by this vulnerability.
If you can’t patch tonight, do this now.
Until upgrading is possible, restrict network access to affected Confluence instances to trusted administrative or application clients and remove unnecessary public exposure. Deploy an IPS signature specifically covering CVE-2023-22527 where available. Monitor suspicious template-related POST requests, unexpected Java-process child shells, unauthorized scheduled jobs, and abnormal outbound connections. Restrict unnecessary services and application shell capabilities where feasible. These measures reduce exposure but do not replace patching; no verified application-level workaround is established.
Patch, then assume compromise.
Immediately upgrade to the latest vendor-supported Confluence release confirmed to address CVE-2023-22527. Historical fixed releases include Confluence Data Center and Server 8.5.4 LTS, and Confluence Data Center 8.6.0 and 8.7.1, but these should not be treated as current upgrade targets because they may lack subsequent security fixes. Investigate previously exposed, unpatched instances for compromise: patching alone does not remove existing webshells, implants, stolen credentials, or persistence mechanisms.
15 exploits validated by Mallory's analysis. Hidden: 4 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
53 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.