CVE-2023-22527: Confluence RCE Exploit Attempts Persist for Months

A bug that refused to fade

Critical vulnerabilities usually follow a familiar arc. Disclosure triggers a spike in scanning, defenders patch, and attackers move on. Atlassian's Confluence flaw CVE-2023-22527 has not followed that script. Two months after it surfaced in January 2024, sensor data still showed a steady trickle of legitimate exploit traffic aimed at the bug 1.

Atlassian lists the issue in its January 2024 security bulletin as a remote code execution vulnerability in out-of-date versions of Confluence Data Center and Server 4. That wording matters. The risk sits with organizations running older self-managed installations, which is exactly the population that tends to lag on updates.

Why the flaw is so attractive

The vulnerability's appeal to attackers is easy to explain. An unauthenticated remote attacker can execute arbitrary code and system commands on the underlying operating system with the privileges of the Confluence user, and no user interaction is needed 2. Bluefire Redteam describes this as a strong foothold that can be used to push deeper into a network 2.

Confluence also offers a large target pool. GreyNoise estimates the product has somewhere around 4,000 instances in its view, which it calls a very popular footprint 1. Atlassian bugs also have a track record of attracting attackers. GreyNoise points back to January coverage noting that Confluence flaws are frequently exploited in the wild 1.

The early surge

The opening phase was loud. Bluefire Redteam cites the Shadowserver Foundation, whose honeypots recorded more than 700,000 exploitation attempts from roughly 2,000 unique IP addresses spread around the world 2.

The sources disagree on timing, however. Bluefire places Shadowserver's mass-scanning report on January 30, a day before what it calls Atlassian's advisory release. It reads that sequence as evidence that attackers had early knowledge of the flaw and working proof-of-concept code before defenders could react 2. Atlassian's own index simply files the CVE under its January 2024 bulletin 4. That makes the "pre-disclosure" framing harder to square with the vendor's timeline. Readers should treat the claim of attackers having advance knowledge as one outlet's interpretation, not an established fact.

What the long tail looks like

The more revealing data comes later. Over a single week roughly two months after disclosure, GreyNoise counted about 350 POST requests across its sensor fleet hitting the affected endpoint, /template/aui/text-inline.vm 1.

The payloads were not generic probes. GreyNoise observed requests that appeared to use the Confluence bug to try logging into Tomcat Manager with a hardcoded pair of credentials: username afiiskc and password akkckx 1. Searching for those strings turned up almost nothing, only a few defunct sites that likely just echoed back HTTP requests 1.

That same password showed up about 42,000 times in a week, coming from six different, apparently unrelated sources 1. In practice, this looks like a credential baked into reusable tooling. The automation chains a fresh RCE with older Tomcat-focused tradecraft and keeps running long after the headlines have faded.

A recurring Atlassian pattern

CVE-2023-22527 is part of a longer history. Atlassian's advisory archive shows a January 2023 notice for Jira Service Management Server and Data Center covering CVE-2023-22501 4. That critical authentication flaw let attackers with certain privileges impersonate users who had never logged in, once they obtained those users' signup tokens 3. As with the Confluence bug, the exposure was limited to self-managed deployments. Jira Cloud was not affected 3.

The two bugs work very differently. One allows unauthenticated code execution, while the other is a conditional impersonation flaw. What they share is the risk profile. On-premises Atlassian products sit inside corporate networks, hold sensitive internal data, and depend on administrators applying patches themselves.

The takeaway

The lesson from CVE-2023-22527 is that exploitation has a half-life, not an end date. The roughly 700,000-attempt surge described by Shadowserver 2 got the attention. The more practical concern is the steady background noise GreyNoise measured months later 1. Once a reliable unauthenticated RCE is built into scanning toolkits, it keeps running for as long as unpatched servers remain online, at little cost to the attackers.

Organizations still running out-of-date Confluence Data Center or Server should not assume the danger peaked in January. It should be treated as ongoing exposure. Patching is the priority, followed by checking logs for requests to the text-inline.vm endpoint and for unexpected Tomcat Manager login attempts. The persistence of this activity also suggests that "months old" is no reason to lower the priority of a critical Atlassian advisory.