Atlassian Confluence is one of the most widely deployed enterprise wiki and collaboration platforms, sitting at the heart of corporate knowledge bases, technical documentation, and internal processes. That centrality makes it a high-value target: a compromised Confluence instance often contains source code snippets, infrastructure credentials, internal API keys, and sensitive business data embedded directly in page content. Two critical OGNL injection vulnerabilities — CVE-2022-26134 and the even more severe CVE-2023-22527 (CVSS 10.0) — gave unauthenticated attackers full remote code execution on unpatched servers, and both remain actively exploited in the wild. Beyond unpatched CVEs, misconfigured anonymous space access, REST API token abuse, and Jira integration credential exposure round out the Confluence attack surface. This guide covers systematic Confluence security assessment for penetration testers and security teams.
Freshly installed Confluence instances expose a setup wizard that, if left incomplete or accessible after setup, can allow an attacker to create a new administrator account or reveal internal configuration details. The setup wizard is accessible at /setup/setupadministrator.action and related endpoints — on an already-configured instance, any response other than a redirect to the login page warrants investigation.
# Check for exposed setup wizard — should redirect (302) on configured instances
curl -s -o /dev/null -w "%{http_code}" \
http://confluence.example.com/setup/setupadministrator.action
# 200 = setup wizard still accessible (critical misconfiguration)
# 302 = properly configured
# Check additional setup endpoints
for path in \
"/setup/setupstart.action" \
"/setup/finishsetup.action" \
"/setup/setupdbchoice.action" \
"/bootstrap/firstrun.action"; do
CODE=$(curl -s -o /dev/null -w "%{http_code}" \
"http://confluence.example.com${path}")
echo "${CODE} ${path}"
doneBeyond the setup wizard, early Confluence versions shipped with no default administrative credentials — the admin account is created during setup. However, many organizations use weak passwords such as admin, confluence, or the company name for the initial administrator. Test authentication at /login.action and observe whether the response includes a Confluence version banner in HTTP headers or page source, which directly informs which CVEs apply.
# Extract version from login page or HTTP headers
curl -s -I http://confluence.example.com/login.action | grep -i "x-confluence\|server\|atlassian"
# Version also visible in meta tags
curl -s http://confluence.example.com/login.action \
| grep -i "version\|ajs-version-number\|build-number" | head -5CVE-2023-22527 is a template injection vulnerability in Confluence Data Center and Server versions 8.0.x through 8.5.3 (and some 8.6.x and 8.7.x versions). It allows unauthenticated remote code execution via OGNL (Object-Graph Navigation Language) expression injection in the template parameter of the /_/;/WEB-INF/web.xml endpoint path traversal chain. Atlassian rated this CVSS 10.0 — the maximum possible score — and it was widely exploited within days of disclosure in January 2024.
Affected versions: Confluence Data Center and Server 8.0.0 – 8.5.3. Versions 7.x and earlier are not affected. Confluence Cloud is not affected.
| Version Branch | Affected Range | Fixed Version |
|---|---|---|
| 8.5.x (LTS) | 8.5.0 – 8.5.3 | 8.5.4 or later |
| 8.4.x | 8.4.0 – 8.4.5 | Upgrade to 8.5.4+ |
| 8.3.x | 8.3.0 – 8.3.4 | Upgrade to 8.5.4+ |
| 8.2.x | 8.2.0 – 8.2.3 | Upgrade to 8.5.4+ |
| 8.1.x | 8.1.0 – 8.1.4 | Upgrade to 8.5.4+ |
| 8.0.x | 8.0.0 – 8.0.4 | Upgrade to 8.5.4+ |
For detection purposes (without triggering active exploitation), check whether the target version falls in the vulnerable range and probe for the characteristic endpoint response pattern. A safe version-based detection approach:
# Safe detection: version check only (no payload execution)
# Extract the version number and compare against affected ranges
VERSION=$(curl -s "http://confluence.example.com/login.action" \
| grep -o 'ajs-version-number" content="[0-9.]*"' \
| grep -o '[0-9.]*')
echo "Detected Confluence version: ${VERSION}"
# Check if endpoint structure is present (indicator of 8.x, not exploit)
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
-X POST "http://confluence.example.com/template/aui/text-inline.vm" \
-H "Content-Type: application/x-www-form-urlencoded" \
--data-urlencode "queryString=x")
echo "Template endpoint response: ${HTTP_CODE}"
# 200 on an 8.x instance = endpoint present, check version for exploitability
# 404 = not present or patched path
# For authorized testing environments: nuclei template is the standard approach
# nuclei -t cves/2023/CVE-2023-22527.yaml -u http://confluence.example.comThe vulnerability exploits a server-side template injection path where OGNL expressions in the queryString parameter are evaluated without sanitization. In exploitation, attackers achieve code execution by injecting expressions such as @java.lang.Runtime@getRuntime().exec(). Patch immediately — there is no workaround other than upgrading or taking the instance offline.
CVE-2022-26134 preceded CVE-2023-22527 and affected all Confluence Server and Data Center versions before 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1. It allowed unauthenticated remote code execution via OGNL injection in HTTP request URI components and was actively exploited as a zero-day before Atlassian issued patches in June 2022. Both CVE-2022-26134 and CVE-2023-22527 share the same root cause: unsafe OGNL evaluation in the Confluence template and action processing layer.
# CVE-2022-26134 — detection via URI-based OGNL injection indicator
# The vulnerability triggers via specially crafted URIs like:
# GET /%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28...%29%7D/
# Safe detection: check for the vulnerable endpoint pattern
# Look for Confluence version in the 7.x pre-patch range
VERSION_CHECK=$(curl -sk "https://confluence.example.com/rest/api/space" \
-o /dev/null -w "%{http_code}")
echo "REST API accessible: ${VERSION_CHECK}"
# Check Server header for version disclosure
curl -skI "https://confluence.example.com/" \
| grep -i "x-confluence-request-time\|atl-token\|server"
# For authorized testing: nuclei detection template
# nuclei -t cves/2022/CVE-2022-26134.yaml -u https://confluence.example.com
# Affected version ranges to flag during assessment:
# All versions before: 7.4.17 / 7.13.7 / 7.14.3 / 7.15.2 / 7.16.4 / 7.17.4 / 7.18.1Confluence exposes a comprehensive REST API at /rest/api/ that allows programmatic access to spaces, pages, attachments, and user data. Personal Access Tokens (PATs) — also called API tokens in Confluence Cloud — are long-lived bearer tokens that bypass the standard session authentication flow and are frequently found hardcoded in CI/CD pipelines, automation scripts, and developer dotfiles. A single leaked PAT provides access to everything the associated user can read, including restricted spaces.
# Test API token validity and retrieve authenticated user info
TOKEN="your-api-token-here"
CONFLUENCE_URL="https://confluence.example.com"
# Confluence Cloud — basic auth with API token (email:token)
curl -s -u "user@example.com:${TOKEN}" \
"${CONFLUENCE_URL}/rest/api/space?limit=50" \
| python3 -m json.tool | grep -E '"key"|"name"|"type"'
# Confluence Server/DC — Personal Access Token (Bearer)
curl -s -H "Authorization: Bearer ${TOKEN}" \
"${CONFLUENCE_URL}/rest/api/space?limit=50" \
| python3 -m json.tool | grep -E '"key"|"name"|"type"'
# Enumerate all pages in a space (replace SPACE_KEY with discovered key)
curl -s -H "Authorization: Bearer ${TOKEN}" \
"${CONFLUENCE_URL}/rest/api/content?spaceKey=SPACE_KEY&limit=100&expand=version,body.storage" \
| python3 -m json.tool
# Search all content for sensitive keywords
curl -s -H "Authorization: Bearer ${TOKEN}" \
"${CONFLUENCE_URL}/rest/api/content/search?cql=text+%7E+%22password%22&limit=25" \
| python3 -m json.tool | grep -E '"title"|"_links"'
# Search for credentials and secrets in page content
for keyword in "password" "secret" "api_key" "aws_access" "private_key" "token" "credentials"; do
echo "=== Searching for: ${keyword} ==="
curl -s -H "Authorization: Bearer ${TOKEN}" \
"${CONFLUENCE_URL}/rest/api/content/search?cql=text+%7E+%22${keyword}%22&limit=5" \
| python3 -m json.tool | grep '"title"'
done
# List all attachments (may include config files, keystores, .env files)
curl -s -H "Authorization: Bearer ${TOKEN}" \
"${CONFLUENCE_URL}/rest/api/content?type=attachment&limit=100" \
| python3 -m json.tool | grep -E '"title"|"mediaType"'The Confluence Query Language (CQL) used in the content search endpoint is particularly powerful for an attacker: a single query can surface every page containing the word "password" or "secret" across all accessible spaces. Treat Confluence API tokens with the same sensitivity as production database credentials — they often provide access to exactly that.
Confluence supports anonymous access at both the global and per-space level. When Allow Anonymous Access to the Site is enabled globally and individual spaces inherit this setting (or are explicitly set to public), sensitive internal documentation becomes accessible without authentication. This is one of the most common high-impact findings in enterprise Confluence assessments — particularly in organizations that migrated from on-premises to Data Center and inadvertently carried over permissive legacy configurations.
# Test anonymous access — no credentials provided
curl -s "http://confluence.example.com/rest/api/space" \
| python3 -m json.tool | grep -E '"key"|"name"|"type"'
# Non-empty results without auth = anonymous access enabled globally
# List all publicly accessible spaces
curl -s "http://confluence.example.com/rest/api/space?limit=100" \
| python3 -c "
import json, sys
data = json.load(sys.stdin)
spaces = data.get('results', [])
print(f'Anonymous-accessible spaces: {len(spaces)}')
for s in spaces:
print(f\" [{s.get('type','?')}] {s.get('key','?')} — {s.get('name','?')}\")
"
# Attempt to read page content without authentication
curl -s "http://confluence.example.com/rest/api/content?limit=25" \
| python3 -m json.tool | grep -E '"title"|"spaceKey"'
# Check global permissions endpoint (may expose permission matrix)
curl -s "http://confluence.example.com/rest/api/space/_private/permissions" \
-o /dev/null -w "HTTP %{http_code}\n"
# Enumerate space permissions for a specific space
curl -s "http://confluence.example.com/rest/api/space/SPACE_KEY/permission" \
| python3 -m json.tool | grep -E '"type"|"subjects"'Beyond direct API access, anonymous users on a misconfigured instance can use Confluence's built-in search to discover content across all public spaces. Even "internal" spaces with no login requirement regularly contain architecture diagrams, runbooks, infrastructure passwords, and sensitive meeting notes.
The Confluence REST API exposes user search functionality that does not require elevated privileges and — depending on configuration — may be accessible to all authenticated users or even anonymously. The /rest/api/user/search endpoint accepts partial username strings and returns matching user objects including email addresses, display names, and account identifiers. This enables rapid directory harvesting for subsequent credential attacks or social engineering campaigns.
# User enumeration via REST API search
CONFLUENCE_URL="https://confluence.example.com"
# Anonymous user enumeration attempt (works on misconfigured instances)
curl -s "${CONFLUENCE_URL}/rest/api/user/search?username=a&limit=200" \
| python3 -m json.tool | grep -E '"username"|"displayName"|"email"'
# Authenticated enumeration — iterate alphabet to harvest all users
for letter in {a..z}; do
curl -s -H "Authorization: Bearer ${TOKEN}" \
"${CONFLUENCE_URL}/rest/api/user/search?username=${letter}&limit=50" \
| python3 -c "
import json, sys
data = json.load(sys.stdin)
for u in data:
print(u.get('username',''), u.get('displayName',''), u.get('email',''))
" 2>/dev/null
done | sort -u
# Get current user info (validates token and reveals account details)
curl -s -H "Authorization: Bearer ${TOKEN}" \
"${CONFLUENCE_URL}/rest/api/user/current" \
| python3 -m json.tool
# Enumerate group memberships
curl -s -H "Authorization: Bearer ${TOKEN}" \
"${CONFLUENCE_URL}/rest/api/group?limit=50" \
| python3 -m json.tool | grep '"name"'
# List members of the confluence-administrators group
curl -s -H "Authorization: Bearer ${TOKEN}" \
"${CONFLUENCE_URL}/rest/api/group/confluence-administrators/member?limit=50" \
| python3 -m json.tool | grep -E '"username"|"displayName"'Confluence also leaks user information through the /rest/api/content endpoint's history and version expansion parameters, which expose the usernames of everyone who has ever edited a page. Cross-referencing page authors with the user search results provides a highly accurate view of the full user directory without explicitly querying user endpoints.
Confluence macros are executable components embedded in page content using the {macro-name:parameter=value} syntax. Certain macro types — particularly the HTML macro, Script macro, and third-party macros from the Atlassian Marketplace — execute code in the context of the Confluence server or user's browser, creating stored XSS and server-side injection vectors. The HTML macro is disabled by default precisely because it allows arbitrary HTML and JavaScript injection into pages; enabling it is a critical misconfiguration frequently seen in older instances.