Injection attack From Confluence

[李鑫峰]

These days, our server in ECS is attacted. It's reported that a bash runned.

[Iresh Rupasinghe]

Please patch your server soon as possible.

https://searchsecurity.techtarget.com/news/252506129/Atlassian-Confluence-flaw-under-active-attack

Solution: 

https://jira.atlassian.com/browse/CONFSERVER-67940?src=confmacro

[Kishan Sharma]

Yes, seems like @李鑫峰 is affected by CVE-2021-26084 Confluence Server Webwork OGNL injection . Applying the workaround script will assist in temporarily mitigating against all known vulnerable end points.

[Daniel Ebers]

Hi @李鑫峰

while patching the vulnerable Confluence installation alongside with removing the malicious crypto miner is the correct measure in first place you would need to assess if the server is compromised in a way it needs probably to be restored from backup.

Basically a machine got hacked like yours should not be trusted anymore. Please do a thorough check of the environment, too. The malware seen in that cases is reported to "jump" to other hosts, too.

Regards,
Daniel