THE THREAT
2024-01-22 Update: As of January 21st, there are reports of real-world exploitation of CVE-2023-22527
On January 16th, Atlassian disclosed a new critical Remote Code Execution (RCE) vulnerability that impacts Confluence Data Center and Confluence Server. The vulnerability, tracked as CVE-2023-22527 (CVSS: 10), allows a remote and unauthenticated threat actor to execute arbitrary code on impacted systems.
At this time, there is no indication of active exploitation of CVE-2023-22527. As this vulnerability has a maximum severity rating and enables unauthenticated RCE, it will attract significant attention from both security researchers and threat actors. The eSentire Threat Intelligence team assesses with high confidence that real-world exploitation will occur in the near future.
What we’re doing about it
- eSentire Managed Vulnerability Service (MVS) has plugins to detect versions of Confluence vulnerable to CVE-2023-22527
- The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities
What you should do about it
- After performing a business impact review, apply the relevant security patches released by Atlassian
- Confluence Data Center and Server 8.5.4, 8.5.5 (LTS)
- Confluence Data Center 8.6.0, 8.7.1, 8.7.2 (Data Center Only)
- If patching is not immediately possible, Atlassian recommends:
- Taking impacted systems offline immediately
- Back up the data of impacted systems to a secure location outside of the Confluence instance
- Engage your security team to review for any signs of potential malicious activity
- Where possible, avoid exposing Confluence Data Centers and Servers to the Internet
Additional information
It is critical that organizations apply the relevant Confluence security patches as soon as possible. As technical details surrounding the security patch are publicly available, threat actors are almost certainly attempting to reverse engineer the changes to develop an exploit. Due to these details, there is only a short time window for defenders to deploy the patches before exploitation occurs. The eSentire Threat Intelligence team was able to identify over 60,000 Confluence servers exposed to the internet; hundreds of these devices were confirmed to be exploitable via CVE-2023-22527.
Impacted Confluence Data Center and Confluence Server Versions:
- 8.0.x
- 8.1.x
- 8.2.x
- 8.3.x
- 8.4.x
- 8.5.0-8.5.3
It should be noted that CVE-2023-22527 does not impact Atlassian Cloud sites. Confluence sites, accessible via the Atlassian.net domain, are not vulnerable to exploitation.
References:
[1] https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html
[2] https://confluence.atlassian.com/kb/faq-for-cve-2023-22527-1332810917.html
