erroneo.us
Search all guides⌘K

Security Digest · Jan 16, 2024 · Vulnerability · Other

Confluence CVE-2023-22527: Pre-Auth OGNL Injection RCE

Template injection in Confluence Data Center and Server 8.0-8.5.3 gave unauthenticated RCE; mass-exploited for miners and Sliver. Verify upgrades and hunt.

Published By erroneo.us Security Desk · Updated 3 min read11 sources

Our verdict

Check exposure

Fixed since December 2023 and mass-exploited since January 2024; confirm no Confluence 8.0 to 8.5.3 build is left, move off end-of-life Server, and if an old instance faced the internet, hunt for miners and implants instead of trusting a later upgrade.

Who must act: Owners of self-managed Confluence Data Center or Server still on 8.0.x through 8.5.3, anyone still running Confluence Server (no security patches since February 15, 2024), and teams whose 8.x instance was internet-facing and unpatched in early 2024.

Who can relax: Atlassian Cloud customers, 7.19.x LTS users for this bug only, and Data Center teams on a current LTS who keep the instance off the open internet.

Affected
Confluence Data Center and Server 8.0.x through 8.4.x, including 8.4.5
Confluence Data Center and Server 8.5.0 through 8.5.3
Fixed in
Confluence 8.5.4 LTS and later (Data Center and Server)
Confluence Data Center 8.6.0, 8.7.1 and later
Current Data Center lines: at least 9.2.26 or 10.2.19, because of CVE-2026-21589
CVSS
10.0 (v3.0, CNA)
EPSS
100.0% (percentile 100.0)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Record the version of every Confluence instance from Administration > General Configuration > System Information or the page footer.
  2. Upgrade Data Center to a current LTS, at least 9.2.26 or 10.2.19, which also fixes CVE-2026-21589.
  3. Retire Confluence Server: it has had no security patches since February 15, 2024; move to Data Center or Cloud.
  4. Remove direct internet exposure and put Confluence behind a VPN or an authenticating proxy.
  5. If an affected build faced the internet in or after January 2024, run the hunt below, rebuild the host if anything turns up, and rotate the database, LDAP and integration credentials it holds.

How to check if you are affected or compromised

  • grep Confluence access logs for POST /template/aui/text-inline.vm; Rapid7 saw these return HTTP 200 in real compromises.
  • Search Catalina logs for warnings about an X-Cmd-Response header, which Rapid7 found alongside the miner download URL.
  • Look for /tmp/w.sh, javs.tar.gz, a javasgs_miner.service unit, /tmp/X-org, /tmp/X0 and outbound traffic to 38.6.173.11 or 193.29.13.179:8888.
  • Check for cron jobs named whoami, nginx or apache, processes running from /tmp, and ssh runs with -oStrictHostKeyChecking=no -oBatchMode=yes from the Confluence host.

What happened#

On January 16, 2024, Atlassian disclosed CVE-2023-22527, a template injection flaw in older Confluence Data Center and Server 8.x builds. It lets an unauthenticated attacker run code on the server. Petrus Viet reported it through Atlassian's bug bounty. The code had already been fixed during regular updates, so only 8.x builds released before December 5, 2023 are affected. There was no workaround. Atlassian, the CNA, scores it CVSS 3.0 10.0 on the CVE record. NVD gives 9.8.

On January 22, ProjectDiscovery published the root cause. An unauthenticated POST to /template/aui/text-inline.vm passes the label parameter into an OGNL expression, and a key exposed in the request lets the payload escape the Struts sandbox. The same day, BleepingComputer reported that Shadowserver had logged more than 39,000 exploitation attempts from just over 600 IP addresses, mostly whoami callbacks, and counted 11,100 Confluence instances online. CISA added the CVE to the KEV catalog on January 24, 2024, and marks known ransomware use.

Real intrusions followed. Rapid7 responded to two exploited public Confluence servers that received an XMRigCC miner, then a Sliver command-and-control implant and the Kerbrute, Traitor and Fscan tools. In August 2024, Trend Micro described three actors using the bug for cryptomining. They spread over SSH and persisted through cron.

Who is affected#

Confluence Data Center and Server 8.0.x through 8.4.x, including 8.4.5, and 8.5.0 through 8.5.3. Fixed releases are 8.5.4 LTS and later, and Data Center 8.6.0, 8.7.1 and later. The 7.19.x LTS line and Atlassian Cloud are not affected. Confluence Server itself is end of life. Atlassian's announcement says Server products stopped receiving "security patches" after February 15, 2024.

Do you really need to act?#

Most teams patched in early 2024, so the verdict is check exposure. Two cases still need work. First, any 8.x instance that faced the internet before it was upgraded may hold a miner, an implant or stolen credentials, and a later upgrade does not remove them. Second, "patched for this CVE" is not enough today. CVE-2026-21589, an unauthenticated file read in Confluence Data Center fixed in 9.2.26 and 10.2.19, joined KEV on October 15, 2026. A Server license gets no fix for it.

What to do now#

  1. Record each instance's version from Administration > General Configuration > System Information.
  2. Upgrade Data Center to a current LTS, at least 9.2.26 or 10.2.19.
  3. Plan the move off Confluence Server to Data Center or Cloud, and keep it off the internet until then.
  4. Put Confluence behind a VPN or an authenticating proxy.
  5. If an affected build was exposed in or after January 2024, run the checks below. If anything turns up, rebuild the host and rotate the database, LDAP and integration credentials it holds.

How to tell if you were hit#

  • Search access logs: grep -h 'POST /template/aui/text-inline.vm' <confluence-install>/logs/*access*. Rapid7 saw these return 200. Atlassian published no indicators of compromise.
  • Look for Catalina log warnings about an X-Cmd-Response header. Rapid7 found the miner download URL there.
  • Check for /tmp/w.sh, javs.tar.gz, a javasgs_miner.service unit, /tmp/X-org or /tmp/X0, and traffic to 38.6.173.11 or 193.29.13.179:8888.
  • Per Trend Micro, look for cron jobs named whoami, nginx or apache, processes running from /tmp, and ssh -oStrictHostKeyChecking=no -oBatchMode=yes runs from the Confluence host.

Timeline#

  • — Builds released from this date are not affected, per Atlassian.
  • — Atlassian publishes the advisory and the CVE.
  • — ProjectDiscovery publishes the root cause, and Shadowserver reports more than 39,000 attempts.
  • — CISA adds the CVE to KEV.
  • — Server support ends. Rapid7 publishes its incident report.
  • — Trend Micro details cryptojacking campaigns.
  • — CVE-2026-21589 joins KEV.

Vulnerability records

  • CVE-2023-22527 · KEV 2024-01-24 · A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Atlassian — CVE-2023-22527: RCE (Remote Code Execution) Vulnerability In Confluence Data Center and Confluence Server confluence.atlassian.com
  2. Atlassian — Farewell Server, Hello Cloud atlassian.com
  3. CVE record — CVE-2023-22527 cve.org
  4. NVD — CVE-2023-22527 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities: CVE-2023-22527 cisa.gov
  6. CVE record — CVE-2026-21589 cve.org
  7. CISA — Known Exploited Vulnerabilities: CVE-2026-21589 cisa.gov
  8. ProjectDiscovery — Atlassian Confluence SSTI Remote Code Execution projectdiscovery.io
  9. Rapid7 — RCE to Sliver: IR Tales from the Field rapid7.com
  10. Trend Micro — Cryptojacking via CVE-2023-22527: Dissecting a Full-Scale Cryptomining Ecosystem trendmicro.com

Coverage and analysis

  1. BleepingComputer — Hackers start exploiting critical Atlassian Confluence RCE flaw bleepingcomputer.com