cve-2024-21683-rce

CVE-2024-21683 is a critical remote code execution (RCE) vulnerability affecting Atlassian's Confluence Server and Data Center.

This vulnerability has a CVSS score of 8.3, placing it in the high-severity category. Attackers can exploit this vulnerability to execute remote code by crafting malicious JavaScript files, without requiring user interaction.

However, attackers must first be logged into the Confluence system and possess sufficient permissions to add new macro languages.

Vulnerability Details

• Vulnerability Type: Remote Code Execution (RCE)
• Affected Versions: Confluence 5.2 and all subsequent versions
• Attack Conditions:
  • The attacker must already be an authenticated Confluence user with administrator privileges.
  • The attacker needs to exploit the "Add New Language" option in the "Configure Code Macro" feature to upload a malicious JavaScript file.

Root Cause

This vulnerability stems from an input validation flaw in the "Add New Language" feature. Due to the lack of effective input validation, an authenticated attacker can inject malicious JavaScript code that executes on the server side, potentially leading to severe consequences such as sensitive information disclosure, data modification, or denial of service (DoS).

Attack Method

Attackers can exploit this vulnerability through the following methods:

• Accessing specific API endpoints.
• Uploading files containing malicious code, or creating new users with administrator privileges by crafting malicious requests.