Daniel Eads Atlassian Team

Hi Joao, Here's a screenshot of the install wizard: The explanation text reads "Choose this option if you want to try Confluence. We'll set up a trial database for you. The embedded database is for evaluation only. Later you'll need to migrate to your own external database." I can see how this could be overlooked though as…

Based on this, it seems like you might have been affected by a malware attack from the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20). Do you remember exactly when you upgraded Confluence? We started seeing attacks in the wild for this vulnerability on April 10.…

Hey Boris, Thanks for listing the processes you found and steps you went about detecting them. No system is 100% secure, including Confluence, and including Linux. If you didn't receive an email notification from Atlassian about this advisory several weeks ago urging an upgrade, you can double-check your notification…

Hi Hur, Is it safe to assume this started happening over the last day or two? Based on your version and symptoms, it sounds like your instance might be affected by an opportunistic attack against the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20). We've seen an…

Hi Johan, Based on your Confluence version, symptoms, and output from top showing the suspicious looking processes (./o3LPbfh ./nafOeFd in your output) it sounds like your instance might be affected by an opportunistic attack against the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security…

Hi Thomas, Based on your version and symptoms, it sounds like your instance was affected by an opportunistic attack against the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20). We've seen an infection going around that injects malware and the bitcoin miner it…

Hey @Becky Kirk , While the first attack seemed to focus on injecting the kerberods malware, we are seeing reports of other attacks trying to deliver payloads of different malware. I can see that you've been working with our senior Support Engineers via ticket on support.atlassian.com. It's not clear from the ticket that…

Hey @Robert Musto , I'm really sorry to hear that you had a bad experience getting support. I took a look at the tickets you had opened and while there were a few duplicates created, it seems like our support engineers were able to assist you over the phone today. If there were some things you felt needed improvement, we'd…

Hey there, I agree with your diagnosis that you've been infected specifically with kerberods malware as linked in the other thread, based on the pastebin script that it pulled. As described in the linked thread that you read, there's a two-step process needed to get this resolved: * Upgrade Confluence to a version…

Hey @Rakesh Kumar Srivastava , It looks like you are running Confluence 6.2.0 which is vulnerable to a malware attack we've seen in the wild. The symptoms you described match an active exploit that attacks the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20).…

Hi Erwin, What version of Confluence do you have installed currently? When you run top on the server, does it look like the CPU is running at 100% ? The symptoms you described match an active exploit that attacks the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory -…

Hey @Kamrul Khan , What version of Confluence are you running? The symptoms you described match an active exploit that attacks the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20). We've seen attackers infect servers with malware that tries to mine bitcoin. The…

Hi Peter, What version of Confluence do you have installed currently? The symptoms you described match an active exploit that attacks the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20). We've seen attackers infect servers with malware that tries to mine bitcoin.…

Hi Joao, Are you getting a particular error when trying to set up Confluence with PostgreSQL? Worth noting that Confluence currently supports PostgreSQL 9.6 but not the 10 or 11 releases. A full list of supported databases can be found here. In terms of infected files, it's likely that what you've described is an active…

Hi Boris, Given the timeframe you mentioned, what you've described is an active exploit that attacks the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20). We've seen an infection going around that injects malware and the bitcoin miner it tries to run uses all the…

Hey Thomas, Sorry your post was marked as spam! Our system is often a little overzealous in trying to remove posts. We manually go through the spam queue on weekdays, but posts on Friday evenings/weekends might not get reviewed until Mondays. I've unmarked the question as spam and everyone should be able to see it now.…

Hey Dick, We describe the various support options (so you can compare if you'd like to go to Priority or Premier) on our Atlassian Support Offerings page. At the bottom of the comparison matrix are links you can use to generate quotes and order online. Of course if you have questions, you can email us, but you can also…

Hey Marta, I've checked the details on your license and as you found in your support ticket, your maintenance expired before we released patched versions of Confluence. Downgrading to 6.6 isn't something I wouldn't recommend attempting (as you concluded also, since we don't publish info to do it!) Having been working on…

Hey Ron, For the case of not having a smartphone, you'll need to use Authy. They offer a desktop application which you can use without a smartphone at all. From their download page, you can either select the Desktop client or get the version that runs as a Chrome extension. After it's set up, you can follow the Bitbucket…

We typically see this error when your LDAP servers / domain controllers are using self-signed certs or certificates issued by a provider like GoDaddy which may not be in the Java trust store. The fastest way to address this (so you don't have to change things on the LDAP server side) is to import the certificate into the…

Hey there, In addition to Dave's great troubleshooting steps, you can also determine the version of Confluence even if it is off (which will be helpful information for us). The installation directory for Confluence contains a file called README.txt. At the top of this file, the version of Confluence is listed. Thanks!…

Hi Denis, Given the timeframe you mentioned, what you've described is an active exploit that attacks the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20). The first step in fixing this is upgrading to a Confluence version that is not affected by the vulnerability.…

What you've described is an active exploit that attacks the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20). The first step in fixing this is upgrading to a Confluence version that is not affected by the vulnerability. The latest releases are: * 6.6.13 (6.6 is…

Hey Ken! Given the version of Confluence you are on, it's likely that an administrator disabled the macro to mitigate CVE-2019-3396 as described in our security advisory. The fix for this is upgrading Confluence to a recent version where the vulnerability is patched. If you are curious on the timeline for your instance's…

Hi Rashmi, welcome to Community! I want to just double-check that you're talking about the Roadmap Planner macro that comes with Confluence. The one that looks roughly like this: This is rendered on the page as text and CSS, so there's no direct image output to the page. If you were looking for a graphic to embed in a…

Haha, this is truly great! Thanks for squeezing us all in there - you've got a long arm!

As a follow-up, we're compiling some information on scanners that picked up the Kerberods package. If you feel comfortable sharing what detected this for you, that'd be helpful info for us. Thank you!

Hey Andre, What you've described is an active exploit that attacks the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20). You mentioned upgrading to the latest point release, but I just want to be very explicit about what latest versions are mitigated. The last…

Hey @Eugene Chu , As Petr mentioned, the plugin compatibility checker is a very helpful tool as it will check all your installed plugins for compatibility with newer versions of Confluence by fetching their most recent version information from Marketplace. It is accessible from the admin panel: * From the top navigation…

A concern might be that any machine in any part of your network that had WebDAV access could be used as an attack vector. A non-privileged attacker could still exploit a vulnerable Confluence instance from the part of your network that still had WebDAV access. While I definitely appreciate your efforts in trying to come up…