URGENT | System infected - CVE-2021-26084 does NOT bring any relieve

Question

Hello everybody,

our system has been infected by the

CVE-2021-26084 - Confluence Server Webwork OGNL injection

We have a) updated the Confluence instance to version 7.13.1 (running on Debian), applied the patch and restarted the whole system multiple times.

We still have the same problem. Once Confluence is started, the infected script starts up and prevents Confluence from starting.

Any suggestions as to what we can do?

Nikolaus Rupp_ieywn5 · Answer

Thanks @bill_baileyfor your input.

However, that does not resolve my problem / question regarding the backup / restore process and its safeliness regarding the injection.

@Alexis RobertCan you help?

Thanks a million in advance.

bill_bailey · Answer

I got hit with this under Centos. Cryptominer scum. It chews up your memory and CPU so that your Confluence instance is starved. I was never able to fully remove the threat, but I was able to block the websites it was downloading from, so that I could kill the miner and it would not respawn.

My suggestion is to immediately perform a system backup. And I think it is easier to spin up a new instance and then restore your backup to the new instance.

Good luck.

Nikolaus Rupp_ieywn5 · Answer

Hi @AL

that's basically the worst case szenario I have strongly hoped to be able to avoid.

So you're saying, that I can backup installation and home folders and move to a new server? It was my understanding, that I would (at least) need to backup the confluence mysql db as well!?!?

Furthermore:
I could not find detailed explanation on what the injection actually does. Is it "just" rendering the server useless, or is it actually stealing data from the confluence database?

Thanks in advance

--Niko