Cannot start or stop Confluence

Boris Zinchenko

We have Confluence 6.11.2 running on Ubuntu 18.04.1 with PostgreSQL. It is a small test instance with a dozen of spaces and two users. It was running for half a year without issues. Recently it abruptly stopped running. 

Strange things happen:

• On start Confluence consumes 100% of processor and runs infinitely without actually starting.
• It is impossible to stop it in normal way through "stop-confluence.sh".
• It is impossible to kill it in process list: it restarts. 
• It is impossible even to prevent it from starting. We turned off auto-start for the service but it still starts automatically few minutes after reboot.

In all, it made our server not usable. It all happened abruptly without any changes to server or Confluence config from our side. If anybody might have an idea, please advise. Thank you.

Daniel Eads

Hi Boris,

Given the timeframe you mentioned, what you've described is an active exploit that attacks the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20). We've seen an infection going around that injects malware and the bitcoin miner it tries to run uses all the CPU available on the box.

The first step in fixing this is upgrading to a Confluence version that is not affected by the vulnerability. I'd recommend looking at one of these versions (latest releases as of this post):

• 6.13.4 (6.13 is an Enterprise release)
• 6.14.3
• 6.15.2

Secondly, the LSD malware cleanup tool will be useful for removing the Kerberods malware. I would recommend executing cleanup after upgrading Confluence to a patched version so there's no possibility of re-infection while you work on the upgrade.

Please let me know if you have more questions!
Daniel | Atlassian Support