CVERadar
CRITICAL · CVSS 3.1 9.8CISA KEV · added 2024-01-24Metasploit modulePublic PoCKnown ransomware useEPSS 99.98% (p100)Threat level 99

CVE-2023-22527: Atlassian Confluence Data Center and Server Template Injection Vulnerability

Atlassian · Confluence Data Center and Server · NVD published 2024-01-16 · posted 2026-10-21 · last modified 2026-06-17

What it is

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

WeaknessCWE-74
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (source: [email protected])
CISA due date2024-02-14 (for US federal agencies under BOD; a good deadline for everyone)
ATT&CK tacticsStealth → Impact

Exploitation evidence

First exploit evidence seen: 2024-01-16 (earliest date across the sources below).

Exploited in the wild

  • CISA KEV: listed since 2024-01-24. Source

Public exploit code

Metasploit

GitHub proof-of-concept repositories

23 public repositories from 23 accounts, first seen 2024-01-16. Most starred: Boogipop/CVE-2023-22527-Godzilla-MEMSHELL (75 stars), view repository.

Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.

Sources: CISA KEV · Rapid7 Metasploit Framework module metadata · nomi-sec/PoC-in-GitHub.

Defend the Chain

The attack chain for CVE-2023-22527 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.

Threat level 99/100
Defender level 1 · 0 XP
Chain links broken: 0/2

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Stealth

Defense Impairment

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Pick a red technique card on the board, then choose the defence that stops it.

Defend against T1221 Template Injection CTID: exploitation technique

CVE-2023-22527 is a template injection vulnerability that allows an unauthenticated adversary to achieve remote code execution. Adversaries have been observed exploiting this vulnerability for cryptomining purposes.

How to fix it

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. (source: CISA KEV)

Fixed versions

  • atlassian confluence data center: upgrade to 8.5.4 or later (affected from 8.0.0)
  • atlassian confluence server: upgrade to 8.5.4 or later (affected from 8.0.0)

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

MITRE ATT&CK mitigations for this chain

  • M1049 Antivirus/Antimalware (for T1221) : Network/Host intrusion prevention systems, antivirus, and detonation chambers can be employed to prevent documents from fetching and/or executing malicious payloads.
  • M1031 Network Intrusion Prevention (for T1221) : Network/Host intrusion prevention systems, antivirus, and detonation chambers can be employed to prevent documents from fetching and/or executing malicious payloads.
  • M1017 User Training (for T1221) : Train users to identify social engineering techniques and spearphishing emails that could be used to deliver malicious documents.
  • M1042 Disable or Remove Feature or Program (for T1221) : Consider disabling Microsoft Office macros/active content to prevent the execution of malicious payloads in documents , though this setting may not mitigate the [Forced Authentication](https://attack.mitre.org/techniques/T1187) use for this technique.

Detection Generic guidance

  • Impact: Monitor service availability, unexpected encryption activity and mass file changes.

Response checklist Generic guidance

  1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
  2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
  3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
  4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.

Sources