Critical RCE Vulnerability Found in Older Atlassian Confluence Versions

January 16, 2024

Atlassian has alerted users to a critical remote code execution (RCE) vulnerability affecting older versions of Confluence Data Center and Confluence Server, including out-of-support releases. The vulnerability, labeled as CVE-2023-22527, is severe (with a CVSS v3 score of 10.0) and allows unauthenticated attackers to perform remote code execution on affected Confluence endpoints.

Atlassian's security bulletin clarifies that the most recent supported versions of Confluence Data Center and Server are not susceptible to this vulnerability, due to mitigation during regular updates. However, the company advises users to install the latest version to safeguard their instances from non-critical vulnerabilities outlined in their January Security Bulletin.

The RCE vulnerability affects Confluence Data Center and Server versions from 8.0.x to 8.5.3. Atlassian has addressed the flaw in versions 8.5.4 (LTS), 8.6.0 (Data Center only), and 8.7.1 (Data Center only), which were released in December. It's uncertain whether the bug was deliberately fixed last month or if it was inadvertently rectified during regular software updates.

Administrators who have updated to a more recent release are safe from CVE-2023-22527 exploitation. Atlassian emphasizes that versions 8.4.5 and all prior release branches that are no longer supported will not receive a security update under its security bug fix policy. Users of these versions are urged to switch to an actively supported release as soon as possible.

Atlassian has not provided any mitigation or workarounds for this security issue, so applying the available updates is the recommended course of action. A FAQ page set up by Atlassian for the flaw explains that it does not affect Confluence LTS v7.19.x, Cloud Instances hosted by the vendor, or any other Atlassian product. However, even instances not connected to the internet and those that do not permit anonymous access are still vulnerable, albeit at a reduced risk.

For those unable to apply the updates immediately, the recommendation is to take affected systems offline, back up the data to a location outside the Confluence instance, and monitor for malicious activity. Atlassian Confluence bugs are frequently exploited by attackers, including state-sponsored threat groups and opportunistic ransomware groups. In the case of CVE-2023-22527, Atlassian cannot provide any significant indicators of compromise (IoCs) to assist in detecting exploitation due to the multiple possible entry points and the ability to use the flaw in chained attacks.

Latest News

Like what you see?

Get a digest of headlines, vulnerabilities, risk context, and more delivered to your inbox.

Subscribe Below

By submitting this form, you’re giving us permission to email you. You may unsubscribe at any time.

Accelerate Security Teams

Continuously identify and prioritize the risks that are most critical in your environment, and validate that your remediation efforts are reducing risk. An always-on single source-of-truth of your assets, services, and vulnerabilities.