When the vulnerability was announced last week, we powered off our server until the patch was made available, and then applied it. We are running Confluence Server 7.13.7 LTS.
Earlier today, Sophos Antivirus for Linux (running on our Confluence Server) detected a virus:
What was detected: Troj/WebShel-CS
We require 2FA authentication to login to Confluence, so I'm not sure how this was uploaded, unless some vulnerability still exists?
I created this support case on your behalf over in https://getsupport.atlassian.com/servicedesk/customer/portal/14/CSP-307744
I expect that our Confluence support team will want to gather logs from your environment in order to make sure that your system has been upgraded to a fixed version for this CVE.
Hello, @Steven Mezzadri
Based on file name and location this could be a regular file upload via Confluence (unrelated to CVE-2022-26134).
I suggest you actually raise it with Atlassian support and conduct some form of forensic analysis to understand how this file got there.
Atlassian support might be able to assist, that is assuming they are actually interested to confirm that it's NOT due to ineffective fix.
Feeling overwhelmed by the demands of work and life? With a 25% increase in the prevalence of anxiety and depression worldwide during the pandemic, for most of us, it’s a resounding yes . 🙋♀️ ...
Connect with like-minded Atlassian users at free events near you!Find an event
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no Community Events near you at the moment.Host an event
You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events