CVE-2023-22527: Confluence template injection, check and fix
Last updated:
A template injection in out-of-date versions of Confluence 8 Data Center and Server lets an unauthenticated attacker run code on the server through the /template/aui/text-inline.vm endpoint.
Atlassian rates it 10.0 (CVSS 3.0) and NVD 9.8 (CVSS 3.1). Exploitation started within days of the January 2024 advisory, and Atlassian lists no workaround: the fix is the upgrade.
At a glance
- CVE
- CVE-2023-22527
- Software
- Atlassian Confluence Data Center and Server
- Affected versions
- 8.0.x to 8.4.x and 8.5.0 to 8.5.3 (NVD also lists Data Center 8.7.0)
- Fixed in
- 8.5.4 and 8.5.5 (LTS); Data Center only: 8.6.0, 8.7.1, 8.7.2
- CVSS score
- 9.8 Critical (NVD, CVSS 3.1) ·
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CISA Known Exploited Vulnerabilities
- Yes, added on January 24, 2024
- Published by NVD
- January 16, 2024
- InfraFence virtual patch
vp-cve-2023-22527(ModSecurity id 9920006)
What is affected
Confluence Data Center and Server 8.0.x to 8.4.x and 8.5.0 to 8.5.3; NVD also lists Data Center 8.7.0. The 7.19.x Long Term Support versions are not affected, and neither is Confluence Cloud. Atlassian's fixed releases are 8.5.4 and 8.5.5 (LTS) and, for Data Center only, 8.6.0, 8.7.1 and 8.7.2; it recommends the latest version.
Check whether a server is vulnerable
Read the version in the footer of any page, or under Administration › General Configuration › System Information, and compare it with the list above.
Attempts are requests to the template endpoint:
sudo grep -rhi 'text-inline.vm' --include='*access*' --exclude='*.gz' /var/log/apache2 /var/log/httpd 2>/dev/null | tail -20Fix it
- Back up the database and the Confluence home folder.
- Upgrade to the latest release of a supported line, following Atlassian's upgrade guide; on a cluster, every node.
- Check the version shown in the footer after the restart.
Warning: There is no configuration workaround. A vulnerable instance that was reachable from the internet should be checked for compromise (unknown processes, files in the install and home folders) after the upgrade.
How InfraFence blocks it while you update
The virtual patch for CVE-2023-22527 is a ModSecurity rule that blocks every request whose decoded, normalized path ends in /template/aui/text-inline.vm, whatever its parameters.
Note: It protects Confluence only behind Apache with ModSecurity on the same server. Requests to Confluence's own port are not seen: keep that port closed to the internet.
How the patch is applied
- The agent notes which SSH ports and sites answer.
- It writes the rule (ModSecurity id 9920006) between its own markers in its ModSecurity file, runs
apachectl configtestand reloads Apache gracefully. A failed test puts the previous file back. - It checks that SSH and the sites still answer, and removes the patch if they do not.
- It checks that ModSecurity really blocks with the rule, with a harmless local probe request. A ModSecurity in
DetectionOnlyonly logs: the patch is then removed and reported as ineffective, never as applied.
Every request the patch blocks is reported with CVE-2023-22527 (agent 1.0.37 or later): you see the attempts on the server's activity and on the Exploitation page of the dashboard, so you know the vulnerability is being tried against you.
Warning: A virtual patch blocks the known form of the attack on the requests that go through Apache on that server. It is not a substitute for the update: install the fixed version, then remove the patch from Activity with Undo if you no longer need it.
Virtual patches need Apache with ModSecurity, the setting Allow web server configuration changes, and no hosting panel or configuration manager in charge of the web server; they are part of the Pro plan and AutoMode. A person applies them from the AI analysis, or AutoMode does. See Virtual patches.
Sources
The facts on this page come from these sources; check them for changes.
Try it free on 1 server
Starter is free for one server, with full protection and automatic blocking. No credit card.
Install the agent as root, with your token in place of <TOKEN>:
curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash -s -- --token <TOKEN>The token is created in the dashboard, in Servers › Add server.