URGENT | System infected - CVE-2021-26084 does NOT bring any relieve

[Nikolaus Rupp]

Hello everybody,

our system has been infected by the

CVE-2021-26084 - Confluence Server Webwork OGNL injection

We have a) updated the Confluence instance to version 7.13.1 (running on Debian), applied the patch and restarted the whole system multiple times.

We still have the same problem. Once Confluence is started, the infected script starts up and prevents Confluence from starting.

Any suggestions as to what we can do?

[Kishan Sharma]

Hi @Nikolaus Rupp Welcome to the Atlassian Community!

Since the vulnerability has been already fixed in v7.13.0+ you shouldn't be facing any issues with it. I would advise raising a support ticket to Atlassian Support for immediate attention.

[Alexis Robert]

Hi @Nikolaus Rupp , 

you will probably need to quarantine the infected server, and move your Confluence installation to a new system. You would have to copy the Confluence folders (installation and home folders), and adapt your configuration if needed.

Or you can get in touch with an antivirus specialist to get rid of the infected script. The patch is not intended to "cure" the system, but only to prevent further infection.

Let me know if this helps, 

--Alexis

[Nikolaus Rupp]

Hi @AL

that's basically the worst case szenario I have strongly hoped to be able to avoid.

So you're saying, that I can backup installation and home folders and move to a new server? It was my understanding, that I would (at least) need to backup the confluence mysql db as well!?!?

Furthermore:
I could not find detailed explanation on what the injection actually does. Is it "just" rendering the server useless, or is it actually stealing data from the confluence database?

Thanks in advance

--Niko

[bill_bailey]

I got hit with this under Centos. Cryptominer scum. It chews up your memory and CPU so that your Confluence instance is starved. I was never able to fully remove the threat, but I was able to block the websites it was downloading from, so that I could kill the miner and it would not respawn.

My suggestion is to immediately perform a system backup. And I think it is easier to spin up a new instance and then restore your backup to the new instance.

Good luck.

[Nikolaus Rupp]

Thanks @bill_baileyfor your input.

However, that does not resolve my problem / question regarding the backup / restore process and its safeliness regarding the injection.

@Alexis RobertCan you help?

Thanks a million in advance.