---
title: "Confluence OGNL RCE (CVE-2023-22527)"
canonical: https://trickest.com/library/confluence-rce-check-cve-2023-22527
description: "Point hosts at Confluence and flag CVE-2023-22527 by version, then confirm with a GET of /template/aui/text-inline.vm. No OGNL. CISA KEV."
---

# Confluence OGNL RCE (CVE-2023-22527)

## Overview

This workflow finds Atlassian Confluence and sorts each host by whether its version falls in the CVE-2023-22527 range. CVE-2023-22527 is unauthenticated OGNL injection in `/template/aui/text-inline.vm`. CISA listed it on KEV after confirmed use. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the public login page, reads the version from `ajs-version-number`, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). Version flag is first. Hosts in range get a second node that GETs `/template/aui/text-inline.vm` with no query string. It does not send an expression.

Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. Fingerprint each host as Confluence from `/login.action`, then read the version and compare it to the CVE-2023-22527 range table in the graph.
3. Confirm only those flagged hosts with an unauthenticated GET of `/template/aui/text-inline.vm`. It does not send an expression.
4. Collect the per-host rows: product match, version, affected flag, confirmed flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, affected, confirmed, and errors.

## Inputs

- **Target list.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a `url` field also works. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Confluence was detected, the version read, the affected flag, and whether the Velocity template path answered.
- **summary.json.** Counts across the list: targets, product hits, affected, confirmed, and errors.

## Integrations

- HTTP. Unauthenticated GET to the login page and, on flagged hosts only, `/template/aui/text-inline.vm` with no query string. No OGNL payload.

## Sample output

The records below are illustrative and do not come from a real run. They show one Confluence host inside the CVE-2023-22527 range, one patched host, and one host that is not the product.

```jsonl
{"target_url": "https://wiki.example.com", "product_detected": true, "version": "8.5.3", "affected": true, "confirmed": true, "error": null}
{"target_url": "https://wiki.example.org", "product_detected": true, "version": "8.5.4", "affected": false, "confirmed": false, "error": null}
{"target_url": "https://shop.example.net", "product_detected": false, "version": null, "affected": false, "confirmed": false, "error": "not_product"}
```

```json
{"cve": "CVE-2023-22527", "total_targets": 3, "affected": 1, "not_affected": 1, "errors": 1}
```

## FAQ

### Which Confluence versions does this flag?

8.0 through 8.4, 8.5.0 through 8.5.3, and 8.7.0. 8.5.4, 8.6.0, and 8.7.1 are the floors the graph treats as not affected. 7.19.x is not in the affected set. The compare uses the version the product itself served.

### Does a confirmed row mean OGNL ran?

No. Confirm only GETs `/template/aui/text-inline.vm` with no query string. It does not send an expression. A confirmed row means the Velocity template path still answers.

### Is this check safe on production?

Yes. Fingerprint is read-only GET. Confirm is an unauthenticated GET of the template path, only on hosts already in range. It does not log in or evaluate OGNL.

### Does the check need credentials?

No. It fingerprints the public login page the way an external scanner would.

### What is CVE-2023-22527?

Unauthenticated OGNL injection in the Confluence Velocity template path. CISA listed it on KEV after confirmed use. This workflow flags by version, then confirms the template path without an expression.

## Related workflows

- [Confluence Authz (CVE-2023-22518)](/library/confluence-authz-check-cve-2023-22518). Reach for it when the next Confluence flag is setup-restore, not OGNL.
- [Jenkins CLI File Read (CVE-2024-23897)](/library/jenkins-path-traversal-check-cve-2024-23897). Reach for it when the next confirm is also a surface GET, not an exploit.
- [TeamCity Auth Bypass (CVE-2024-27199)](/library/jetbrains-teamcity-auth-bypass-cve-2024-27199). Reach for it when the next host is a CI server.

---
_Markdown source of https://trickest.com/library/confluence-rce-check-cve-2023-22527._