Vulnerability Analysis | Atlassian Confluence Template Injection Code Execution Vulnerability (CVE-2023-22527)

Atlassian Confluence is an enterprise-grade collaboration and document management software developed and maintained by the Australian company Atlassian. It provides an integrated platform that enables teams to collaboratively create, share, and manage project documents, knowledge bases, meeting notes, and other content.

On January 16, 2024, Atlassian officially disclosed the CVE-2023-22527 Atlassian Confluence template injection code execution vulnerability. Attackers can construct malicious requests to cause remote code execution without logging in. It is recommended to fix the vulnerability as soon as possible.

▌Vulnerability Reproduction

1. Range Environment Setup

Use the following docker-compose.yaml file to set up the range environment.

After starting the container, access http://your-ip. If the following interface appears, the range setup is successful.

2. Vulnerability Exploitation

Use BurpSuite to send the following packets:

According to the response header, we can see that Confluence successfully echoed the /etc/passwd file information.

▌Vulnerability Analysis

Through the interface address, we found the template used for this vulnerability

First of all, it needs to be noted that the Velocity template engine is used here. Velocity is mainly used to merge templates with data to generate text output. In Web development, Velocity is commonly used to generate dynamic web pages, email templates, documents, etc. It supports embedding variables, conditional statements, loop structures, etc., in templates, allowing the template to dynamically generate content based on the given data.

In the first line of the code above, $parameters.label is used to obtain the value of the label parameter in the request body. When we pass in the label parameter, this line of code becomes like the following:

In this code, the function of $stack.findValue is to obtain the value of the parameter through the variable name.

We understand the process of vulnerability exploitation through findValue debugging, and we found the location of this method through debugging:

When this method is executed, it will enter the findValue(String expr, boolean throwExceptionOnFailure) method below, and pass the incoming label parameter to the this.tryFindValueWhenExpressionIsNotNull method for processing.

tryFindValueWhenExpressionIsNotNull passes the parameters to tryFindValue for processing.

In tryFindValue, getValueUsingOgnl is called for processing.

In getValueUsingOgnl, it can be seen that the program directly passes the payload into the this.ognlUtil.getValue method, which will decode the incoming parameters in unicode and execute them.

After following up step by step, the final method to execute the payload is compileAndExecute(). In the breakpoint debugging below, it can be found that the this.expressions.get() method will handle the internal unicode encoding u0027 and single quotes when parsing the payload, so that the quote before aaa closes with the quote decoded from u0027, so the injected code can be executed smoothly, leading to a successful attack.