Atlassian Confluence Server RCE attacks underway

More than 600 IP addresses are launching thousands of exploit attempts against CVE-2023-22527 – a critical bug in out–of-date versions of Atlassian Confluence Data Center and Server – according to non-profit security org Shadowserver. Atlassian disclosed the flaw, a template injection flaw that can allow unauthenticated remote code execution (RCE) attacks, last week. The CVE scored a CVSS rating of 10 out of 10, and it affects Confluence Data Center and Server 8 versions released before December 5, 2023 and versions up to 8.4.5. At the time, the software vendor urged customers to update "immediately" to the latest available version to plug the hole. It appears, however, that not everyone followed this advice. As of Sunday more than 11,000 instances remain exposed on the internet, and criminals are pounding them with RCE attempts. In an Xeet on Monday, Shadowserver reported seeing more than 39,000 such attempts since January 19. "Over 600 IPs seen attacking so far (testing callback attempts and 'whoami' execution)," the security org revealed, alongside a screenshot showing the security events, IPs and unique ports. Soon after, internet scanning outfit GreyNoise also reported RCE exploit attempts. "Patch before it's too late!," the firm warned. Atlassian hasn't updated its CVE-2023-22527 security advisory to indicate any instances of Confluence Server being under active exploitation. A company spokesperson did not answer The Register's questions about attempted or successful RC...