Rapid7 Labs critical experimental sigma

Attempt to Exploit CVE-2023-22527 in Atlassian Confluence

Detects attempts to exploit a template injection vulnerability in Atlassian Confluence Data Center and Server that leads to remote code execution (CVE-2023-22527).

View Source

Detection Logic

{
  "selection": {
    "c-uri": "/template/aui/text-inline.vm",
    "c-method": "POST",
    "c-body": ".*ognl.*"
  },
  "condition": "selection"
}

False Positives

⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...