Unauthorized Remote Code Execution Vulnerability Affects Older Versions of Confluence
Key Information
- Vendor
- Atlassian
- Status
- Confluence Data Center
- Confluence Server
- Vendor
- CVE Published:
- 16 January 2024
Badges
Summary
The vulnerability, CVE-2023-22527, affects older versions of Atlassian Confluence Data Center and Server, allowing unauthenticated attackers to achieve remote code execution. The vulnerability has a CVSS score of 10, making it highly critical and capable of providing unfettered access to corporate environments. It impacts versions 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, and 8.5.0 through 8.5.3, but was ultimately mitigated in the December update. Organizations using end-of-life instances (version 8.4.5 and before) will not receive patches, and there are no mitigations or workarounds available. The possibility of multiple entry points and chained attacks makes it difficult to list all possible indicators of compromise. There is no evidence of active exploitation in the wild, but the bug has the potential to be the target of ransomware campaigns and cyber-espionage attempts. Admins are advised to apply the latest versions and remove systems from the internet if immediate patching is not possible. Templates are generally popular on the cybercrime circuit, given that the platform reaches deep into network environments.
CISA Reported
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2023-22527 as being exploited and is known by the CISA as enabling ransomware campaigns.
The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected Version(s)
Confluence Data Center >= 8.0.0
Confluence Data Center < 8.0.0
Confluence Data Center >= 8.1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
The Hacker News CVE-2023-22527Atlassian Confluence Vulnerability Exploited in Crypto Mining Campaigns
Atlassian Confluence vulnerability CVE-2023-22527 actively exploited for cryptocurrency mining. Urgent patching recommended to prevent attacks.
3 months ago
Silent Intrusions: Godzilla Fileless Backdoors Targeting Atlassian Confluence
Malware Trend Micro discovered that old Atlassian Confluence versions that were affected by CVE-2023-22527 are being exploited using a new in-memory fileless...
3 months ago
Attackers Exploit Critical Atlassian Confluence Flaw for Cryptojacking
Novel attack vectors leverage the CVE-2023-22527 RCE flaw discovered in January, which is still under active attack, to turn targeted cloud environments into cryptomining networks.
3 months ago
EPSS Score
96% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 👾
Exploit exists.
Risk change from: 9.8 to: 10 - (CRITICAL)
Risk change from: 9.8 to: 10 - (CRITICAL)
- 🔥
Vulnerability reached the number 1 worldwide trending spot.
Vulnerability started trending.
First article discovered by Bleeping Computer
Vulnerability published.
Vulnerability Reserved.