CVE-2023-22527: 
Confluence Server Schwachstellenanalyse und -minderung

A template injection vulnerability (CVE-2023-22527) was discovered in older versions of Confluence Data Center and Server that allows an unauthenticated attacker to achieve Remote Code Execution (RCE) on affected instances. The vulnerability affects versions 8.0.x through 8.5.3, while version 7.19.x LTS is not affected. This critical vulnerability received a CVSS score of 9.8 (NIST) and 10.0 (Atlassian) (Atlassian Advisory, NVD).

The vulnerability is classified as a template injection vulnerability (CWE-74) that allows for improper neutralization of special elements in output used by a downstream component. The vulnerability can be exploited without authentication and requires no user interaction, making it particularly dangerous. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and high impact on confidentiality, integrity, and availability (NVD).

The vulnerability allows attackers to execute arbitrary code on affected systems without authentication. It has been actively exploited in cryptojacking attacks, where attackers deploy shell scripts and XMRig miners, target SSH endpoints, kill competing cryptomining processes, and maintain persistence through cron jobs (Trend Micro).

Atlassian recommends immediate patching to the latest versions: 8.5.5 (LTS) for both Server and Data Center, or 8.7.2 for Data Center only. For customers unable to patch immediately, Atlassian recommends taking the system off the internet, backing up data to a secure location outside of the Confluence instance, and engaging local security teams to review for potential malicious activity (Atlassian Advisory).

The vulnerability has garnered significant attention in the security community due to its critical severity and active exploitation. CISA has added it to their Known Exploited Vulnerabilities Catalog with a remediation date of February 14, 2024, indicating its significance (NVD).