Known Confluence vulnerability

Janet Barton

Although we upgraded Confluence yesterday, our Confluence on-premises application server was already compromised. I need help in identifying the known payload activities for servers compromised with this vulnerability.

For clarification, this pertains to Confluence CVE-2021-26084 exploit

Robert Wen_Cprime_

You can see others' tales of woe in this question: https://community.atlassian.com/t5/Confluence-questions/No-access-to-Conlfuence-Webpage-100-CPU-usage-from-quot-dbused/qaq-p/1793393?utm_source=atlcomm&utm_medium=email&utm_campaign=immediate_general_answer&utm_content=topic

Steps included:

- Shut down confluence
- Apply Bugfix patch
- removed all cronjobs, located in /var/spool/cron/crontabs and /var/spool/cron/atjobs
- removed suspicious files in /tmp 
- killed dbused process, via kill -9 [pid]
- Start confluence