40,000+ Attacks in 3 Days: Critical Confluence RCE Under Active Attacks

Destructive actors have started to actively exploit a not long ago disclosed critical security flaw impacting Atlassian Confluence Facts Heart and Confluence Server, inside a few times of community disclosure.

Tracked as CVE-2023-22527 (CVSS score: 10.), the vulnerability impacts out-of-date variations of the software package, allowing for unauthenticated attackers to achieve remote code execution on prone installations.

The shortcoming impacts Confluence Info Middle and Server 8 versions launched prior to December 5, 2023, as effectively as 8.4.5.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

But just times right after the flaw became general public understanding, virtually 40,000 exploitation attempts focusing on CVE-2023-22527 have been recorded in the wild as early as January 19 from far more than 600 exclusive IP addresses, according to both the Shadowserver Foundation and the DFIR Report.

The exercise is presently minimal “screening callback attempts and ‘whoami’ execution,” suggesting that menace actors are opportunistically scanning for susceptible servers for stick to-on exploitation.

A the greater part of the attacker IP addresses are from Russia (22,674), followed by Singapore, Hong Kong, the U.S., China, India, Brazil, Taiwan, Japan, and Ecuador.

About 11,000 Atlassian circumstances have been discovered to be available over the internet as of January 21, 2024, though it really is currently not acknowledged how numerous of them are susceptible to CVE-2023-22527.

“CVE-2023-22527 is a critical vulnerability within just Atlassian’s Confluence Server and Details Heart,” ProjectDiscovery scientists Rahul Maini and Severe Jaiswal claimed in a technical evaluation of the flaw.

“This vulnerability has the probable to permit unauthenticated attackers to inject OGNL expressions into the Confluence instance, thereby enabling the execution of arbitrary code and process instructions.”

Located this short article fascinating? Stick to us on Twitter  and LinkedIn to read much more special content material we post.