Fix for CVE-2022-26134 may be ineffective

[Steven Mezzadri]

When the vulnerability was announced last week, we powered off our server until the patch was made available, and then applied it.  We are running Confluence Server 7.13.7 LTS.

Earlier today, Sophos Antivirus for Linux (running on our Confluence Server) detected a virus:

Path: /var/atlassian/application-data/confluence/temp/upload_fd4c861b_e75a_4310_ae4e_5b10c650bebc_00000009.tmp

What was detected: Troj/WebShel-CS

We require 2FA authentication to login to Confluence, so I'm not sure how this was uploaded, unless some vulnerability still exists?

[Andy Heinzer · Accepted solution]

Hi Steven,

I created this support case on your behalf over in https://getsupport.atlassian.com/servicedesk/customer/portal/14/CSP-307744

I expect that our Confluence support team will want to gather logs from your environment in order to make sure that your system has been upgraded to a fixed version for this CVE.

[Steven Mezzadri]

Thanks, Confluence support determined that the system was already compromised before the patch was applied, so we rolled back several more days.

[Ed Letifov _TechTime - New Zealand_]

Hello, @Steven Mezzadri 

Based on file name and location this could be a regular file upload via Confluence (unrelated to CVE-2022-26134). 

I suggest you actually raise it with Atlassian support and conduct some form of forensic analysis to understand how this file got there.

Atlassian support might be able to assist, that is assuming they are actually interested to confirm that it's NOT due to ineffective fix.