Atlassian Confluence Template Injection RCE (CVE-2023-22527)

CVE-2023-22527 is an unauthenticated OGNL/template injection in Atlassian Confluence Data Center and Server. Attackers achieve RCE on Linux hosts running Confluence — CISA KEV, mass scanning within hours of disclosure.

Affected Confluence

• Confluence Data Center and Server 8.5.x before 8.5.4
• Confluence 8.4.x, 8.3.x, 8.2.x, 8.1.x, 8.0.x per advisory matrix
• Self-hosted on Linux with Tomcat (port 8090/443)

Check version

curl -s http://confluence:8090/status | grep -i version
grep -R 'confluence.version' /opt/atlassian/confluence/ 2>/dev/null

Patching Method

1. Download fixed Confluence JAR/installer from Atlassian security advisory.
2. Backup /var/atlassian/application-data/confluence and database.
3. Stop Confluence: systemctl stop confluence or /opt/atlassian/confluence/bin/stop-confluence.sh
4. Apply upgrade via installer or replace affected JARs per Atlassian KB.
5. Start Confluence; confirm version in About Confluence.
6. Scan for rogue plugins, new admin users, and unexpected network connections.

# Linux Tomcat path — hunt webshells post-patch
find /opt/atlassian/confluence -name '*.jsp' -mtime -14 -ls
grep -R 'cmd.exe\|/bin/bash' /opt/atlassian/confluence/temp/ 2>/dev/null

Workaround until patched

• Block external access to Confluence at firewall/WAF
• Restrict to VPN-only if internal wiki must stay online
• Disable anonymous access and guest spaces