nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Fix for CVE-2022-26134 may be ineffective

Steven Mezzadri

When the vulnerability was announced last week, we powered off our server until the patch was made available, and then applied it. We are running Confluence Server 7.13.7 LTS.

Earlier today, Sophos Antivirus for Linux (running on our Confluence Server) detected a virus:

Path: /var/atlassian/application-data/confluence/temp/upload_fd4c861b_e75a_4310_ae4e_5b10c650bebc_00000009.tmp

What was detected: Troj/WebShel-CS

We require 2FA authentication to login to Confluence, so I'm not sure how this was uploaded, unless some vulnerability still exists?

Accepted answers

Andy Heinzer

Hi Steven,

I created this support case on your behalf over in https://getsupport.atlassian.com/servicedesk/customer/portal/14/CSP-307744

I expect that our Confluence support team will want to gather logs from your environment in order to make sure that your system has been upgraded to a fixed version for this CVE.

All comments

Ed Letifov _TechTime - New Zealand_

Hello, @Steven Mezzadri

Based on file name and location this could be a regular file upload via Confluence (unrelated to CVE-2022-26134).

I suggest you actually raise it with Atlassian support and conduct some form of forensic analysis to understand how this file got there.

Atlassian support might be able to assist, that is assuming they are actually interested to confirm that it's NOT due to ineffective fix.

Andy Heinzer

Hi Steven,

I created this support case on your behalf over in https://getsupport.atlassian.com/servicedesk/customer/portal/14/CSP-307744

I expect that our Confluence support team will want to gather logs from your environment in order to make sure that your system has been upgraded to a fixed version for this CVE.

Steven Mezzadri

Thanks, Confluence support determined that the system was already compromised before the patch was applied, so we rolled back several more days.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

server

confluence-server

cve-2022-26134