Unleashing Chaos – The Atlassian Confluence RCE Vulnerability Saga

Atlassian recently announced a critical Remote Code Execution (RCE) vulnerability in Confluence Data Center and Server 8 versions released before Dec. 5, 2023 as well as 8.4.5 (CVE-2023-22527 – CVSS score: 10.0). Merely days after the flaw became public knowledge, nearly 40,000 exploitation attempts are made.

This is a template injection vulnerability which could allow attackers to inject OGNL (Object-Graph Navigation Language) expressions into the Confluence instance, thereby enabling them to execute arbitrary code and system commands in susceptible installations. This exploitation does not require authentication.

Confluence, like most Atlassian products are written in Java. Java, particularly the Struts framework, uses OGNL (Object-Graph Navigation Language) to represent Java objects. In this scenario, an attacker who can inject an arbitrary OGNL object can execute arbitrary Java code.