Confluence Pre-Auth RCE via OGNL Injection (CVE-2023-22527)

CVE-2023-22527 is a critical remote code execution vulnerability affecting Atlassian Confluence Data Center and Server. This vulnerability allows an unauthenticated attacker to execute arbitrary code on vulnerable instances. The vulnerability stems from a template injection flaw in the "/template/aui/text-inline.vm" endpoint, which allows for OGNL injection via specially crafted POST requests. Successful exploitation grants the attacker complete control over the Confluence server. Publicly available exploit code has increased the risk of widespread exploitation. Defenders should prioritize patching vulnerable systems and implementing detection mechanisms to identify exploitation attempts.

Attack Chain

1. An unauthenticated attacker sends a crafted POST request to the /template/aui/text-inline.vm endpoint on a vulnerable Confluence server.
2. The POST request contains a malicious OGNL expression within the request body.
3. The Confluence server processes the request without proper sanitization of the OGNL expression.
4. The malicious OGNL expression is injected into the Velocity template engine.
5. The Velocity template engine executes the injected OGNL expression.
6. The attacker gains arbitrary code execution on the Confluence server.
7. The attacker leverages code execution to install a webshell for persistent access.
8. The attacker uses the webshell to perform reconnaissance, move laterally within the network, and potentially exfiltrate sensitive data or deploy ransomware.

Impact

Successful exploitation of CVE-2023-22527 allows unauthenticated attackers to achieve remote code execution on affected Confluence servers. This can lead to complete system compromise, data breaches, and lateral movement within the victim's network. Given the widespread use of Confluence in enterprise environments, the impact of this vulnerability is potentially very high, and could affect thousands of organizations.

Recommendation

• Apply the vendor-supplied patch for CVE-2023-22527 to all Confluence Server and Data Center instances immediately.
• Deploy the Sigma rule Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527 to your SIEM to detect exploitation attempts targeting the vulnerable endpoint.
• Monitor web server logs for POST requests to /template/aui/text-inline.vm as identified by the URL IOC */template/aui/text-inline.vm*.
• Review and restrict network access to Confluence servers to only authorized users and systems.