CVE-2023-22527: Another OGNL Injection Leads to RCE in Atlassian Confluence

On January 16, 2024, Atlassian disclosed a remote code execution vulnerability affecting the Confluence Data Center and Confluence Server [1]. CVE-2023-22527 is an OGNL injection vulnerability with a CVSS score of 10 (Critical). Although the vulnerability is fixed with patches, the number of outdated and publicly exposed Atlassian Confluence instances is in the thousands, posing significant risks to organizations.

In this blog, we explained how the Atlassian Confluence CVE-2023-22527 exploit works and how organizations can defend against  CVE-2023-22527 attacks.

Simulate Vulnerability Exploitation Attacks with 14-Day Free Trial of Picus Platform

Atlassian Confluence CVE-2023-22527 Vulnerability Explained

Atlassian Confluence is a collaboration and documentation platform designed to facilitate communication and information sharing within organizations. Confluence Server is a self-hosted version of the platform, allowing organizations to deploy it on their own servers or cloud infrastructure. Confluence Data Center, on the other hand, is an enterprise-grade solution designed for organizations with larger user bases or those with a need for high availability and reliability. On January 16, 2024, Atlassian disclosed an OGNL injection vulnerability affecting the Confluence Data Center and Confluence Server. Adversaries may exploit the CVE-2023-22527 vulnerability for unauthenticated remote code execution in vulnerable Confluence instances. The vulnerability has a CVSS score of 10 (Critical). The affected versions are listed below.

According to ShadowServer, there are over 11,000 Atlassian Confluence instances publicly exposed, and adversaries are actively scanning for vulnerable instances [2]. Organizations are advised to patch their Atlassian Confluence instances as soon as possible.

Previously, in September 2021 and June 2022, two separate OGNL injection vulnerabilities were found in Atlassian Confluence. For more detailed information, you can check our "Atlassian Confluence Zero-Day CVE-2022-26134 Vulnerability" and "Atlassian Confluence CVE-2021-26084 Vulnerability" blog posts.

What is an OGNL Injection Attack?

Object-Graph Navigation Language (OGNL) is a Java-based expression language commonly employed in frameworks and applications like Apache Struts and Atlassian Confluence. OGNL provides a concise syntax for expressing complex operations on Java objects, enabling developers to access and manipulate properties, invoke methods, and navigate object relationships in a concise and expressive manner. 

When applications do not properly validate and sanitize user input before using it in OGNL expressions, it may lead to a security vulnerability called OGNL injection. In OGNL injection attacks, adversaries input specially crafted strings containing OGNL expressions into user interfaces or input fields. When the application processes this input without proper validation, the injected OGNL expressions get executed within the application's context. This can lead to a range of security issues, including unauthorized access to sensitive data and remote code execution.

How Atlassian Confluence CVE-2023-22527 Exploit Works?

Atlassian Confluence CVE-2023-22527 vulnerability is an OGNL injection vulnerability that allows unauthenticated adversaries to execute arbitrary commands remotely in a vulnerable Confluence instance. The vulnerability stems from a Velocity template file named "text-inline.vm" [3]. This file allows adversaries to execute commands by using the expression "#request['.KEY_velocity.struts2.context'].internalGet('ognl')". An example payload delivered via an HTTP POST request is given below.

Atlassian Confluence CVE-2023-22527 Vulnerability Exploit Example

How Picus Helps Simulate Atlassian Confluence CVE-2023-22527 Attacks?

We also strongly suggest simulating the Atlassian Confluence CVE-2023-22527 Vulnerability to test the effectiveness of your security controls against sophisticated cyber attacks using the Picus Complete Security Validation Platform. You can also test your defenses against other vulnerability exploitation attacks, such as Citrix Bleed, Follina, and Log4Shell, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for Atlassian Confluence CVE-2023-22527 vulnerability exploitation attacks:

Picus also provides actionable mitigation content. Picus Mitigation Library includes prevention signatures to address Atlassian Confluence CVE-2023-22527 vulnerability and other vulnerability exploitation attacks in preventive security controls. Currently, Picus Labs validated the following signatures for Atlassian Confluence CVE-2023-22527 vulnerability:

Start simulating emerging threats today and get actionable mitigation insights with a  14-day free trial of the Picus Complete Security Validation Platform.

References

[1] "CVE-2023-22527 - RCE (Remote Code Execution) Vulnerability In Confluence Data Center and Confluence Server." Available: https://confluence.atlassian.com/. [Accessed: Jan. 23, 2024]

[2] "Website." Available: https://twitter.com/Shadowserver/status/1749372138685915645

[3] R. Maini, "Atlassian Confluence - Remote Code Execution (CVE-2023-22527)," ProjectDiscovery Blog, Jan. 22, 2024. Available: https://blog.projectdiscovery.io/atlassian-confluence-ssti-remote-code-execution/. [Accessed: Jan. 23, 2024]