40,000+ Attacks in 3 Days: Critical Confluence RCE Under Active Attacks

Destructive actors have started to actively exploit a not long ago disclosed critical security flaw impacting Atlassian Confluence Facts Heart and Confluence Server, inside a few times of community disclosure.

Tracked as CVE-2023-22527 (CVSS score: 10.), the vulnerability impacts out-of-date variations of the software package, allowing for unauthenticated attackers to achieve remote code execution on prone installations.

The shortcoming impacts Confluence Info Middle and Server 8 versions launched prior to December 5, 2023, as effectively as 8.4.5.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

But just times right after the flaw became general public understanding, virtually 40,000 exploitation attempts focusing on CVE-2023-22527 have been recorded in the wild as early as January 19 from far more than 600 exclusive IP addresses, according to both the Shadowserver Foundation and the DFIR Report.

The exercise is presently minimal “screening callback attempts and ‘whoami’ execution,” suggesting that menace actors are opportunistically scanning for susceptible servers for stick to-on exploitation.

A the greater part of the attacker IP addresses are from Russia (22,674), followed by Singapore, Hong Kong, the U.S., China, India, Brazil, Taiwan, Japan, and Ecuador.

About 11,000 Atlassian circumstances have been discovered to be available over the internet as of January 21, 2024, though it really is currently not acknowledged how numerous of them are susceptible to CVE-2023-22527.

“CVE-2023-22527 is a critical vulnerability within just Atlassian’s Confluence Server and Details Heart,” ProjectDiscovery scientists Rahul Maini and Severe Jaiswal claimed in a technical evaluation of the flaw.

“This vulnerability has the probable to permit unauthenticated attackers to inject OGNL expressions into the Confluence instance, thereby enabling the execution of arbitrary code and process instructions.”

Located this short article fascinating? Stick to us on Twitter  and LinkedIn to read much more special content material we post.