Is Confluence vulnerable to the Apache Struts 2 CVE-2023-50164 ?

[Justin Roysdon]

I see that in Confluence 8.0 you moved to Apache Struts 2.

Is Confluence vulnerable to this RCE and do you have a mitigation until you release a patch?

https://www.cisa.gov/news-events/alerts/2023/12/12/apache-software-foundation-updates-struts-2

https://www.akamai.com/blog/security-research/apache-struts-cve-exploitation-attempts

https://nvd.nist.gov/vuln/detail/CVE-2023-50164

Confluence moves to Struts 2 https://confluence.atlassian.com/doc/struts-2-upgrade-1155473773.html

[Justin Roysdon]

https://www.paloaltonetworks.com/blog/prisma-cloud/cve-2023-50164-custom-rules/

More details.

Would be nice to see a public indication from Atlassian that they have confirmed Confluence is not vulnerable to this.

[Kensuke Karukomi （軽込 健介）]

Agreed. 

I'm annoyed with Confluence and CVE-2023-50164.

I asked Atlassian support to confirm whether CVE-2023-50164 affects to Confluence 8.7.1. 
The answer is: CVE-2023-50164 doesn't affect to Confluence 8.7.1. 

However, there is no detail information and official statement about CVE-2023-50164 by Atlassian so far. Hence, it's difficult for me to explain this to Information Security dept.

[Justin Roysdon]

The affected version appears to be installed in the latest Confluence 8.4.14.

# find / -name \*struts*.jar

/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.struts2_struts-compat-6.2.0.jar

/opt/atlassian/confluence/confluence/WEB-INF/lib/com.atlassian.struts2_struts-support-3.0.1.jar

/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.struts_struts2-core-6.3.0-atlassian-8.jar

/opt/atlassian/confluence/confluence/WEB-INF/lib/org.apache.struts_struts2-velocity-plugin-6.3.0-atlassian-8.jar

[Alex Medved _ConfiForms_]

Not trying to tell that org.apache.struts_struts2-core-6.3.0-atlassian-8 includes a fix to CVE-2023-50164

But org.apache.struts_struts2-core-6.3.0-atlassian-8 is different to pure org.apache.struts_struts2-core-6.3.0

So, I guess only Atlassian team could confirm that

Alex

[Justin Roysdon]

They may have added some custom things to it.  But that was released before this vulnerability was announced.  So, I'm not super confident this has been patched.

There may be some other reason why it does not impact Confluence though.

Atlassian could confirm it.  Or some other organization that has tried the Proof of Concept (PoC) against it.

[Justin Roysdon]

I wouldn't be surprised to see it in their next patch cycle Jan 4-6 ish.

[Justin Roysdon]

See here for move to Struts 2 https://confluence.atlassian.com/doc/struts-2-upgrade-1155473773.html