CVE-2023-22527
Atlassian Confluence Data Center and Server Template Injection Vulnerability
Description
CVE-2023-22527 is a critical template injection vulnerability (classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) affecting older versions of Atlassian Confluence Data Center and Server. An unauthenticated remote attacker can exploit this flaw to achieve Remote Code Execution (RCE) on vulnerable Confluence instances by injecting malicious template expressions that are evaluated server-side. The vulnerability carries a maximum CVSS score of 9.8 (CRITICAL) and CISA has confirmed active exploitation in the wild, with ransomware operators known to be actively targeting unpatched Confluence servers. With an EPSS score of 94.4%, exploitation is near-certain, and public exploit code is already available, making immediate patching essential.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| atlassian | confluence data center | >= 8.0.0, < 8.5.4; 8.7.0 |
| atlassian | confluence server | >= 8.0.0, < 8.5.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615(Vendor Advisory)
- https://jira.atlassian.com/browse/CONFSERVER-93833(Issue Tracking, Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/pwning-confluence-via-ognl-injection-for-fun-and-learning-cve-2023-22527(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527(US Government Resource)
Weakness Type
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)
CVE-2023-22527 is rooted in an injection weakness (CWE-74) where Atlassian Confluence fails to properly neutralize user-supplied input that is subsequently processed by its server-side template engine. This allows an unauthenticated attacker to inject template expressions into Confluence's processing pipeline, causing arbitrary code to be evaluated and executed with the privileges of the Confluence server process.
Learn more: CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component
Impact Analysis
CVE-2023-22527 holds a CVSS 3.1 score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Attack Vector (Network): the vulnerability is remotely exploitable without any physical or network-adjacent access, meaning any internet-exposed Confluence instance is at direct risk. Attack Complexity (Low) and Privileges Required (None): no authentication or special conditions are required — any unauthenticated attacker can send a crafted HTTP request to trigger the vulnerability. User Interaction (None): the attack proceeds entirely without victim interaction. Confidentiality (High), Integrity (High), and Availability (High): a successful exploit grants the attacker full Remote Code Execution capabilities on the Confluence server, allowing complete data exfiltration, system modification, and service disruption. The EPSS score of 94.4% confirms near-certain exploitation activity, and confirmed ransomware operator interest makes this vulnerability an immediate, severe business risk.
Exploit Maturity
Public exploit code is available for CVE-2023-22527 via Packet Storm Security and an additional exploit write-up is published at vicarius.io. CISA has confirmed active exploitation in the wild, with ransomware operators known to be targeting unpatched Confluence servers — this vulnerability should be treated as under active attack. With an EPSS score of 94.4% (99.96th percentile), exploitation is near-certain, and the combination of public PoC code, ransomware campaigns, and unauthenticated RCE potential makes CVE-2023-22527 one of the most dangerous vulnerabilities currently in circulation.
Remediation
- Apply vendor mitigations immediately: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Upgrade to a supported, patched version of Atlassian Confluence: Atlassian has mitigated this vulnerability in the most recent supported versions of Confluence Data Center and Server — upgrade to the latest available release following Atlassian's January Security Bulletin guidance.
- Isolate or take offline unpatched Confluence instances: If immediate patching is not possible, remove internet-facing exposure of Confluence by placing it behind a VPN or firewall that restricts access to trusted internal users only, eliminating the unauthenticated remote attack vector.
- Monitor for exploitation indicators: Review Confluence server logs for unexpected template expression patterns, unusual HTTP POST requests to internal endpoints, and signs of outbound connections or command execution initiated by the Confluence process.
- Implement input validation and WAF rules: Deploy WAF rules to detect and block template injection patterns (e.g., OGNL expression syntax) targeting Confluence endpoints, and ensure server-side template engines are configured to operate in a safe, sandboxed mode in future deployments.
Technical Details
CVE-2023-22527 exploits a template injection weakness (CWE-74) in the OGNL (Object-Graph Navigation Language) template processing pipeline used by older versions of Atlassian Confluence Data Center and Server. Template injection vulnerabilities occur when user-supplied input is embedded into a server-side template without proper sanitization or escaping, causing the template engine to evaluate attacker-controlled expressions as code rather than data. In the Confluence context, an unauthenticated attacker can send specially crafted HTTP requests containing OGNL expressions to vulnerable endpoints, which are then evaluated by the server with Confluence's process privileges — resulting in arbitrary Remote Code Execution. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) captures the worst-case exploitability profile: network-accessible, no authentication, no user interaction, and full system compromise. Atlassian has confirmed that the most recently supported versions of Confluence are not affected, as the vulnerability was mitigated during regular version updates.
Frequently Asked Questions
Is CVE-2023-22527 being actively exploited?
Yes. CISA has confirmed active exploitation and added CVE-2023-22527 to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 14, 2024. Ransomware operators are actively targeting unpatched Confluence servers, and public exploit code is available at multiple sources.
What products are affected by CVE-2023-22527?
CVE-2023-22527 affects older versions of Atlassian Confluence Data Center and Atlassian Confluence Server. The most recent supported versions of both products have been patched. Atlassian recommends upgrading to the latest release and reviewing the January Security Bulletin for specific affected version ranges.
How do I fix CVE-2023-22527?
Upgrade Atlassian Confluence Data Center or Server to the latest supported version that contains the fix for CVE-2023-22527. If immediate patching is not feasible, isolate the Confluence instance from internet exposure and restrict access to trusted networks. Consult Atlassian's official security advisory for version-specific guidance.
How severe is CVE-2023-22527?
CVE-2023-22527 is rated CRITICAL with a CVSS 3.1 score of 9.8 — the highest possible severity. The EPSS score of 94.4% (99.96th percentile) confirms near-certain exploitation activity, and the combination of unauthenticated Remote Code Execution, public exploit availability, and confirmed ransomware usage makes this one of the most urgent vulnerabilities to remediate.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.