nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Confluence was hacked

Администратор_h27nyi

Hello! I have Confluence on my server ver. 6.8.

It was hacked somehow and somebody uses it to spam and flood from my server.

How is it possible? I have only atlassian (+nginx) and postgres on the server.

The malware is running as "confluence" user. They changed the crontab and run scripts from pastebin.com.

Снимок экрана 2019-04-15 в 18.09.39.png

Accepted answers

Администратор_h27nyi

This is my situation https://community.atlassian.com/t5/Confluence-questions/How-come-my-confluence-installation-was-hacked-by-Kerberods/qaq-p/1054605

All comments

Администратор_h27nyi

In syslog I see:

syslog.3.gz:Apr 12 14:10:21 vm-wiki-01 dbus[1064]: [system] Activating via systemd: service name='org.freedesktop.PolicyKit1' unit='polkitd.service'

syslog.3.gz:Apr 12 14:10:21 vm-wiki-01 systemd[1]: Starting Authenticate and Authorize Users to Run Privileged Tasks...

syslog.3.gz:Apr 12 14:10:21 vm-wiki-01 polkitd[13831]: started daemon version 0.105 using authority implementation `local' version `0.105'

syslog.3.gz:Apr 12 14:10:21 vm-wiki-01 dbus[1064]: [system] Successfully activated service 'org.freedesktop.PolicyKit1'

syslog.3.gz:Apr 12 14:10:21 vm-wiki-01 systemd[1]: Started Authenticate and Authorize Users to Run Privileged Tasks.

syslog.3.gz:Apr 12 14:10:23 vm-wiki-01 crontab[13958]: (confluence) REPLACE (confluence)

So I tried to disable polkitd.

Администратор_h27nyi

This is my situation https://community.atlassian.com/t5/Confluence-questions/How-come-my-confluence-installation-was-hacked-by-Kerberods/qaq-p/1054605

Daniel Eads

Hey there,

I agree with your diagnosis that you've been infected specifically with kerberods malware as linked in the other thread, based on the pastebin script that it pulled.

As described in the linked thread that you read, there's a two-step process needed to get this resolved:

Upgrade Confluence to a version unaffected by CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20)
Clean up the malware infection - most folks have had success with the LSD malware cleanup tool.

Let me know if you have any questions about the upgrade!
Daniel | Atlassian Support

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

server

confluence-server

atl-confsec