1name: crowdsecurity/vpatch-CVE-2023-22527
2description: "RCE using SSTI in Confluence (CVE-2023-22527)"
3rules:
4  - and:
5      - zones:
6          - METHOD
7        match:
8          type: equals
9          value: POST
10      - zones:
11          - URI
12        transform:
13          - lowercase
14        match:
15          type: equals
16          value: /template/aui/text-inline.vm
17      - zones:
18          - RAW_BODY
19        transform:
20          - lowercase
21        match:
22          type: contains
23          value: "freemarker.template.utility.execute()).exec"
24labels:
25  type: exploit
26  service: http
27  confidence: 3
28  spoofable: 0
29  behavior: "http:exploit"
30  label: "Atlassian Confluence - RCE"
31  references:
32    - https://blog.projectdiscovery.io/atlassian-confluence-ssti-remote-code-execution/
33    - https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html
34  classification:
35    - cve.CVE-2023-22527
36    - attack.T1595
37    - attack.T1190