CVE-2019-3396

What Is Atlassian Confluence?

Confluence is Atlassian's team collaboration and wiki platform, used across enterprises, government agencies, and software teams to host internal documentation, project plans, and knowledge bases. Because Confluence often stores sensitive internal information and sits alongside other Atlassian tools (Jira, Bitbucket) in an organization's development pipeline, it is a frequent target — compromising it can expose confidential business data and provide a foothold into the broader network.

Overview

CVE-2019-3396 is a critical server-side template injection (SSTI) vulnerability in the Confluence Server and Data Center "Widget Connector" macro. A remote, unauthenticated attacker can exploit it to achieve path traversal and, ultimately, remote code execution on the underlying server, by injecting a malicious Velocity template expression. It carries a CVSS score of 9.8 and was mass-exploited within weeks of disclosure.

Technical Details

The Widget Connector macro embeds external content (such as YouTube or Google Docs widgets) into Confluence pages by rendering a Velocity template based on user-supplied macro parameters. Because the macro fails to properly restrict which template resources can be loaded, an attacker can supply a crafted parameter containing path traversal sequences to reach and render an arbitrary Velocity template file on the server — and because Velocity templates can include executable expressions, this becomes a means of achieving remote code execution rather than just information disclosure. NVD classifies the underlying weakness as CWE-22 (Path Traversal), reflecting that the file-path handling flaw is what enables reaching arbitrary templates for injection.

The attack requires no authentication and no user interaction — a single crafted HTTP request against a Confluence instance with an internet-reachable Widget Connector macro endpoint is sufficient.

Discovery

Atlassian disclosed and patched this vulnerability through its own security advisory process in March 2019.

Exploitation Context

CVE-2019-3396 became one of the most heavily exploited web application vulnerabilities of 2019, weaponized within weeks by cryptomining botnets (notably variants linked to the Muhstik and GandCrab/Sodinokibi-associated toolsets) and later by ransomware operators seeking initial access into corporate networks. Its combination of pre-authentication reach, a single-request exploit, and Confluence's broad enterprise deployment made it a favorite of opportunistic, internet-wide scanning campaigns — a pattern reflected in its ransomware association noted in the CISA KEV catalog.

Remediation

1. Upgrade Confluence Server/Data Center to a patched version per Atlassian's March 2019 advisory (Confluence 6.6.12, 6.12.3, 6.13.3, 6.14.2, or later, as applicable to the release track).
2. Restrict internet exposure of Confluence instances; require VPN or reverse-proxy access controls for external users.
3. Review Confluence logs for anomalous requests to the Widget Connector macro endpoint (rest/tinymce/1/macro/preview and related paths) containing path traversal sequences.
4. Scan for webshells or cryptomining payloads on any Confluence host that was internet-exposed and unpatched during 2019.
5. Establish a rapid-patch process for Atlassian products specifically, given their recurring history as high-value, mass-exploited targets.