Confluence RCE: Your Internal Wiki Just Became Public
Back to Blog
Vulnerability
May 07, 20267 min read

Confluence RCE: Your Internal Wiki Just Became Public

S
Shubham Singla

Alright, let's talk about Confluence. It's that collaborative workspace, that internal wiki, the place where everyone dumps documentation, meeting notes, and sometimes, even sensitive project plans. It’s supposed to be your team's single source of truth, locked down behind the firewall. Well, if you’re running certain versions of Confluence Data Center or Server, that 'locked down' bit just got a whole lot less secure. We're talking about unauthenticated Remote Code Execution (RCE), people. As in, 'anyone on the internet can run commands on your server' kind of RCE.

An abstract image representing a complex network of data or a digital infrastructure with glowing lines and nodes, symbolizing cybersecurity threats and vulnerabilities.

The Leak: CVE-2024-21683

So, the culprit here is CVE-2024-21683. This isn't some niche bug; it's a Server-Side Template Injection (SSTI) vulnerability in Atlassian Confluence Data Center and Server. For the uninitiated, SSTI is like giving someone a fill-in-the-blanks form, but they figure out how to write their own instructions in the blanks that the server then executes. Instead of just filling in 'name' or 'date', they slip in rm -rf /. Not ideal for team collaboration, is it?

Atlassian dropped the news on June 11, 2024. The vulnerability affects a pretty wide range of versions: basically, anything from 8.5.0 up to 8.5.10 (LTS), and all versions in the 8.6.x, 8.7.x, 8.8.x, and 8.9.x lines prior to 8.9.0. If your Confluence instance is sitting pretty on one of these, you’ve got a problem.

How Server-Side Template Injection Works (The Gory Details)

Imagine your Confluence server uses a templating engine (like Velocity or Freemarker, common in Java applications) to dynamically generate HTML pages. It takes user-supplied input – say, for a custom field or a search query – and injects it into a template. The idea is to render user data safely. But when that input isn't properly sanitized, an attacker can inject template language syntax directly. This isn't just HTML injection; this is code injection at the template engine level.

Think of it like this: you give a web server a blueprint for a house and tell it to fill in the color of the walls based on user input. A legitimate user says "blue." An attacker, however, says "execute_command('blow_up_house')." If the templating engine isn't careful, it'll try to build that into the house. Boom. Or, more accurately, RCE.

This particular Confluence bug allows an unauthenticated attacker to inject malicious code into a Confluence template. Because it's unauthenticated, they don't even need valid credentials to kick off the party. They just need to hit your Confluence instance.

A dramatic, dimly lit image of a lock icon over a binary code background, symbolizing ransomware or a critical security breach.

The Impact: What an Attacker Can Do

An unauthenticated RCE is the holy grail for initial access (MITRE ATT&CK T1190 - Exploit Public-Facing Application). Once an attacker can run commands on your Confluence server, they essentially own it. From there, it's a straight shot to:

  • Data Exfiltration: Your internal documentation, project plans, employee lists, client data – all up for grabs.
  • Lateral Movement: Your Confluence server isn't an island. It likely has network access to other internal systems. Attackers will use it as a pivot point to map your internal network, find other vulnerable systems, and escalate privileges (MITRE ATT&CK T1059 - Command and Scripting Interpreter for execution).
  • Persistence: Establishing backdoors, creating new user accounts, or modifying existing services to ensure continued access.
  • Ransomware: Encrypting the Confluence server itself or using it to launch ransomware attacks against other parts of your network.

Imagine your entire corporate knowledge base, including sensitive strategic documents, suddenly controlled by an attacker. It's not just a data breach; it's a company-wide operational paralysis. And let's be honest, how many orgs have Confluence running with direct internet access, even if just through a reverse proxy? Too many.

"The lesson here is simple: if you expose it to the internet, assume someone's already trying to pick the lock. Or, in this case, rewrite the blueprints for the entire building."

Your Move, Partner: Patch, Monitor, Isolate

Atlassian has released patches, and frankly, there's no excuse for delaying. No workarounds exist for this particular vulnerability, so patching is your only real defense here. You need to upgrade your Confluence Data Center or Server instance to one of the fixed versions:

  • 8.5.11 (LTS)
  • 8.9.0 or later

Check Atlassian's security advisory (CONFSERVER-95804) for the definitive list and instructions.

Beyond patching, here's what you should be doing:

  1. Scan Your Instances: Run vulnerability scans against your public-facing Confluence instances. Don't just trust that you're patched; verify.
  2. Monitor Logs: Keep a close eye on your Confluence access logs and server logs for any unusual activity. Look for suspicious requests, especially to templating engine related endpoints, or unexpected command execution. What does unexpected command execution look like? Something like this: GET /template.action?template=%24%7B%23cmd%3D%27id%27%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec(%23cmd)%2C%23b%3Dnew%20java.io.BufferedReader(new%20java.io.InputStreamReader(%23a.getInputStream()))%2C%23c%3D%27%27%2C%23d%3D%27%27%2C%23e%3D%23b.readLine()%2C%23f%3D%23e%21%3Dnull%3F%23e%3A%27%27%2C%23g%3D%23f.length()%3E0%3F%23f%3A%27%27%2C%23h%3D%23g%21%3D%27%27%3F%23g%3A%27%27%2C%23i%3Dnew%20java.util.ArrayList()%2C%23j%3D0%2C%23k%3D%27%27%2C%23l%3D%27%27%2C%23m%3D%27%27%2C%23n%3D%27%27%2C%23o%3D%27%27%2C%23p%3D%27%27%2C%23q%3D%27%27%2C%23r%3D%27%27%2C%23s%3D%27%27%2C%23t%3D%27%27%2C%23u%3D%27%27%2C%23v%3D%27%27%2C%23w%3D%27%27%2C%23x%3D%27%27%2C%23y%3D%27%27%2C%23z%3D%27%27%2C%23aa%3D%27%27%2C%23bb%3D%27%27%2C%23cc%3D%27%27%2C%23dd%3D%27%27%2C%23ee%3D%27%27%2C%23ff%3D%27%27%2C%23gg%3D%27%27%2C%23hh%3D%27%27%2C%23ii%3D%27%27%2C%23jj%3D%27%27%2C%23kk%3D%27%27%2C%23ll%3D%27%27%2C%23mm%3D%27%27%2C%23nn%3D%27%27%2C%23oo%3D%27%27%2C%23pp%3D%27%27%2C%23qq%3D%27%27%2C%23rr%3D%27%27%2C%23ss%3D%27%27%2C%23tt%3D%27%27%2C%23uu%3D%27%27%2C%23vv%3D%27%27%2C%23ww%3D%27%27%2C%23xx%3D%27%27%2C%23yy%3D%27%27%2C%23zz%3D%27%27%2C%23aaa%3D%27%27%2C%23bbb%3D%27%27%2C%23ccc%3D%27%27%2C%23ddd%3D%27%27%2C%23eee%3D%27%27%2C%23fff%3D%27%27%2C%23ggg%3D%27%27%2C%23hhh%3D%27%27%2C%23iii%3D%27%27%2C%23jjj%3D%27%27%2C%23kkk%3D%27%27%2C%23lll%3D%27%27%2C%23mmm%3D%27%27%2C%23nnn%3D%27%27%2C%23ooo%3D%27%27%2C%23ppp%3D%27%27%2C%23qqq%3D%27%27%2C%23rrr%3D%27%27%2C%23sss%3D%27%27%2C%23ttt%3D%27%27%2C%23uuu%3D%27%27%2C%23vvv%3D%27%27%2C%23www%3D%27%27%2C%23xxx%3D%27%27%2C%23yyy%3D%27%27%2C%23zzz%3D%27%27%2C%23aaaa%3D%27%27%2C%23bbbb%3D%27%27%2C%23cccc%3D%27%27%2C%23dddd%3D%27%27%2C%23eeee%3D%27%27%2C%23ffff%3D%27%27%2C%23gggg%3D%27%27%2C%23hhhh%3D%27%27%2C%23iiii%3D%27%27%2C%23jjjj%3D%27%27%2C%23kkkk%3D%27%27%2C%23llll%3D%27%27%2C%23mmmm%3D%27%27%2C%23nnnn%3D%27%27%2C%23oooo%3D%27%27%2C%23pppp%3D%27%27%2C%23qqqq%3D%27%27%2C%23rrrr%3D%27%27%2C%23ssss%3D%27%27%2C%23tttt%3D%27%27%2C%23uuuu%3D%27%27%2C%23vvvv%3D%27%27%2C%23wwww%3D%27%27%2C%23xxxx%3D%27%27%2C%23yyyy%3D%27%27%2C%23zzzz%3D%27%27%2C%23aaaaa%3D%27%27%2C%23bbbbb%3D%27%27%2C%23ccccc%3D%27%27%2C%23ddddd%3D%27%27%2C%23eeeee%3D%27%27%2C%23fffff%3D%27%27%2C%23ggggg%3D%27%27%2C%23hhhhh%3D%27%27%2C%23iiiii%3D%27%27%2C%23jjjjj%3D%27%27%2C%23kkkkk%3D%27%27%2C%23lllll%3D%27%27%2C%23mmmmm%3D%27%27%2C%23nnnnn%3D%27%27%2C%23ooooo%3D%27%27%2C%23ppppp%3D%27%27%2C%23qqqqq%3D%27%27%2C%23rrrrr%3D%27%27%2C%23sssss%3D%27%27%2C%23ttttt%3D%27%27%2C%23uuuuu%3D%27%27%2C%23vvvvv%3D%27%27%2C%23wwwww%3D%27%27%2C%23xxxxx%3D%27%27%2C%23yyyyy%3D%27%27%2C%23zzzzz%3D%27%27%2C%23aaaaaa%3D%27%27%2C%23bbbbbb%3D%27%27%2C%23cccccc%3D%27%27%2C%23dddddd%3D%27%27%2C%23eeeeee%3D%27%27%2C%23ffffff%3D%27%27%2C%23gggggg%3D%27%27%2C%23hhhhhh%3D%27%27%2C%23iiiiii%3D%27%27%2C%23jjjjjj%3D%27%27%2C%23kkkkkk%3D%27%27%2C%23llllll%3D%27%27%2C%23mmmmmm%3D%27%27%2C%23nnnnnn%3D%27%27%2C%23oooooo%3D%27%27%2C%23pppppp%3D%27%27%2C%23qqqqqq%3D%27%27%2C%23rrrrrr%3D%27%27%2C%23ssssss%3D%27%27%2C%23tttttt%3D%27%27%2C%23uuuuuu%3D%27%27%2C%23vvvvvv%3D%27%27%2C%23wwwwww%3D%27%27%2C%23xxxxxx%3D%27%27%2C%23yyyyyy%3D%27%27%2C%23zzzzzz%3D%27%27%2C%23aaaaaaa%3D%27%27%2C%23bbbbbbb%3D%27%27%2C%23ccccccc%3D%27%27%2C%23ddddddd%3D%27%27%2C%23eeeeeee%3D%27%27%2C%23fffffff%3D%27%27%2C%23ggggggg%3D%27%27%2C%23hhhhhhh%3D%27%27%2C%23iiiiiii%3D%27%27%2C%23jjjjjjj%3D%27%27%2C%23kkkkkkk%3D%27%27%2C%23lllllll%3D%27%27%2C%23mmmmmmm%3D%27%27%2C%23nnnnnnn%3D%27%27%2C%23ooooooo%3D%27%27%2C%23ppppppp%3D%27%27%2C%23qqqqqqq%3D%27%27%2C%23rrrrrrr%3D%27%27%2C%23sssssss%3D%27%27%2C%23ttttttt%3D%27%27%2C%23uuuuuuu%3D%27%27%2C%23vvvvvvv%3D%27%27%2C%23wwwwwww%3D%27%27%2C%23xxxxxxx%3D%27%27%2C%23yyyyyyy%3D%27%27%2C%23zzzzzzz%3D%27%27%2C%23aaaaaaaa%3D%27%27%2C%23bbbbbbbb%3D%27%27%2C%23cccccccc%3D%27%27%2C%23dddddddd%3D%27%27%2C%23eeeeeeee%3D%27%27%2C%23ffffffff%3D%27%27%2C%23gggggggg%3D%27%27%2C%23hhhhhhhh%3D%27%27%2C%23iiiiiiii%3D%27%27%2C%23jjjjjjjj%3D%27%27%2C%23kkkkkkkk%3D%27%27%2C%23llllllll%3D%27%27%2C%23mmmmmmmm%3D%27%27%2C%23nnnnnnnn%3D%27%27%2C%23oooooooo%3D%27%27%2C%23pppppppp%3D%27%27%2C%23qqqqqqqq%3D%27%27%2C%23rrrrrrrr%3D%27%27%2C%23ssssssss%3D%27%27%2C%23tttttttt%3D%27%27%2C%23uuuuuuuu%3D%27%27%2C%23vvvvvvvv%3D%27%27%2C%23wwwwwwww%3D%27%27%2C%23xxxxxxxx%3D%27%27%2C%23yyyyyyyy%3D%27%27%2C%23zzzzzzzz%3D%27%27%7D/ This is a URI-encoded template injection payload that tries to execute the id command. Not exactly standard Confluence usage.

  3. Network Segmentation: If your Confluence absolutely *must* be public-facing, segment it. Put it in its own VLAN, behind a WAF, with strict egress filtering. Limit what it can talk to on your internal network. Least privilege applies to network access too.
  4. Web Application Firewall (WAF): A WAF can provide a layer of defense by filtering malicious input before it reaches your application. While not a silver bullet, it can buy you time and block known attack patterns.
  5. Regular Backups: Because when the worst happens, you want to be able to restore without paying a ransom. Test those backups, too.

This isn't new advice, but it's advice that bears repeating every time a major RCE like this drops. Your internal systems are often the richest targets once an attacker gets a foothold. Don't let your internal wiki become the welcome mat for your entire network.