CVE-2023-22527

What it actually does

CVE-2023-22527 is an unauthenticated server-side template injection vulnerability in older Atlassian Confluence Data Center and Confluence Server 8.x releases. A remote attacker can send crafted requests to vulnerable template-rendering functionality and cause the Confluence application process to execute attacker-controlled code or operating-system commands. Because exploitation requires no authentication or user interaction and runs in the context of the Confluence service account, successful exploitation can lead to full application compromise, data theft, plugin or web shell deployment, lateral movement using stored credentials, and service disruption.

Why it matters to the business

A vulnerable internet-facing Confluence instance can be taken over quickly, exposing internal documentation, credentials, project data, customer information, and operational runbooks. The vulnerability has a CVSS score of 9.8, an EPSS probability near 1.0, is listed in CISA KEV, has been actively exploited in the wild, and is associated with ransomware activity, so delayed remediation materially increases the risk of outage, extortion, data breach, and downstream compromise of systems documented or integrated with Confluence. CISA’s KEV remediation deadline was 2024-02-14, meaning organizations subject to KEV requirements should already have remediated or removed affected instances from service.

How an attack unfolds

An attacker first identifies a Confluence Data Center or Server instance and determines whether it is running an affected older 8.x version. They then send a crafted unauthenticated HTTP request to vulnerable template-rendering endpoints, commonly involving Confluence template resources, with template expressions designed to escape normal rendering and invoke Java or operating-system execution primitives. If the instance is vulnerable, the payload executes within the Confluence application process. From there, the attacker may run reconnaissance commands, download tooling, create persistence such as web shells or malicious plugins, access Confluence content and attachments, harvest credentials or tokens from configuration files and application data, and pivot to connected systems. In ransomware-motivated intrusions, the compromised Confluence server may be used as an initial foothold for broader network discovery, credential theft, data exfiltration, and encryption or extortion activity.

How to fix it

Immediately upgrade Confluence Data Center and Confluence Server to a non-affected supported version. Atlassian identified older Confluence 8.x releases as affected; commonly cited affected ranges include 8.0.x through 8.5.3, with 8.5.4 LTS and later versions receiving the mitigation. Where possible, upgrade to the latest supported Confluence release rather than only the minimum fixed release, because Atlassian also addressed additional vulnerabilities in subsequent security bulletins. If immediate upgrade is not possible, remove the instance from the internet, restrict access to trusted networks or VPN, apply compensating controls at the reverse proxy or WAF, and monitor aggressively; however, network controls should be treated only as temporary risk reduction, not a substitute for upgrading. For any instance suspected of compromise, do not rely solely on patching: preserve evidence, isolate the host, rotate credentials and tokens accessible to Confluence, review installed plugins and modified files, and rebuild from a trusted baseline if web shell or post-exploitation activity is found.

How to confirm the fix worked

Confirm the deployed Confluence version from the administrative UI, package inventory, installation files, or application logs and verify it is a supported non-affected release, preferably the latest available version. Review external attack surface inventories, load balancer and reverse proxy configurations, and DNS records to ensure no legacy Confluence nodes remain exposed. Validate that all Data Center nodes in the cluster are upgraded, not just one node. Check reverse proxy, WAF, and web server logs for requests to known template endpoints and suspicious template-expression strings before and after remediation. Where change management permits, perform an authenticated administrative health check and vulnerability scan using a current scanner plugin that detects CVE-2023-22527 exposure. If exploitation is suspected, validate integrity by comparing Confluence installation directories, plugins, startup scripts, scheduled tasks, and recently modified files against a known-good baseline.

Typical attack path

1. Scan for exposed Atlassian Confluence Data Center or Server instances.
2. Fingerprint the Confluence version or attempt safe probing to identify likely affected older 8.x deployments.
3. Send a crafted unauthenticated request to vulnerable template-rendering functionality.
4. Achieve remote code execution in the Confluence application process if the instance is vulnerable.
5. Run command execution checks and collect host, user, network, and application context.
6. Deploy follow-on payloads such as web shells, reverse shells, malicious plugins, miners, or remote access tools.
7. Read Confluence data, attachments, configuration files, database connection details, and stored integration secrets.
8. Use harvested credentials or network access to move laterally to other internal systems.
9. Exfiltrate data and, in ransomware campaigns, stage extortion or disruptive activity.

How to detect it

Review HTTP access logs from Confluence, reverse proxies, load balancers, WAFs, and web servers for unauthenticated requests to template resources, especially /template/aui/text-inline.vm, and for payloads containing Java, FreeMarker, Velocity, or process-execution expressions. Examine Confluence application logs, Tomcat logs, and system logs for errors or stack traces occurring immediately after suspicious template requests. On Linux and Windows hosts, correlate web requests with child processes spawned by the Confluence Java process, such as shell interpreters, PowerShell, curl, wget, certutil, bash, sh, cmd.exe, or unusual scripting runtimes. Inspect the Confluence installation and home directories for recently created or modified JSP files, unexpected plugins, modified startup scripts, suspicious attachment uploads, and files with timestamps near suspicious requests. Review outbound network logs for the Confluence server initiating unusual connections to external IPs, file-sharing sites, paste services, VPS providers, Tor nodes, or command-and-control infrastructure. Check identity and application audit logs for new administrator accounts, plugin installation, configuration changes, token creation, unusual page exports, bulk attachment downloads, and access to sensitive spaces following suspected exploitation. Because exploitation has been observed in ransomware-related activity, extend the hunt beyond the Confluence host to include credential use from the server, remote administration activity, lateral movement, backup access, and mass file access or encryption behavior.

• /template/aui/text-inline.vm
• freemarker.template.utility.Execute
• org.apache.tomcat.InstanceManager
• getRuntime().exec
• java.lang.Runtime
• ProcessBuilder
• cmd.exe /c
• powershell.exe
• /bin/sh -c
• bash -c
• curl http
• wget http
• certutil -urlcache
• atlassian-confluence.log
• catalina.out
• localhost_access_log
• *.jsp
• confluence/plugins
• confluence/WEB-INF
• confluence/pages
• confluence/download/attachments

What your security team should do

• Treat this as an emergency vulnerability for any exposed Confluence Data Center or Server instance because it is unauthenticated RCE, KEV-listed, actively exploited, and associated with ransomware activity.
• Inventory all Confluence Data Center and Server deployments, including test, disaster recovery, archived, and internally exposed instances.
• Upgrade affected Confluence 8.x versions immediately to the latest supported release; ensure every node in a Data Center cluster is remediated.
• If an instance cannot be upgraded immediately, remove it from the internet and restrict access to trusted administrative networks until fixed.
• Hunt historical logs for exploitation attempts and successful post-exploitation activity, especially requests to template endpoints and payload strings invoking Java execution primitives.
• Assume credential exposure if exploitation is confirmed: rotate Confluence administrator credentials, database credentials, API tokens, integration secrets, SSH keys, and any secrets stored in pages or attachments.
• Review the filesystem for unexpected JSP files, modified application files, malicious plugins, suspicious scheduled jobs, and new startup persistence.
• Correlate Confluence activity with endpoint, EDR, proxy, DNS, and identity logs to identify outbound payload retrieval, command execution, lateral movement, or data exfiltration.
• For confirmed compromise, isolate affected hosts, preserve forensic evidence, rebuild from trusted media or snapshots predating compromise, and restore only after patching and credential rotation.
• Maintain WAF or reverse-proxy detections for known exploit patterns even after patching to detect ongoing scanning and attempts against residual assets.