I uploaded unsigned executable (C# compiled with visual studio) to JIRA (tested with cloud and standalone)
Right after upload I downloaded and file was same.
However if I download file after 5-10 minutes, my antivirus (Defender) reported it contains Trojan:MSIL/Masslogger.VN!MTB
I turned off Defender real time protection and did BYTE COMPARISON of files (size was same) and FOUND DIFFERENCES in start sequence.
Does anyone have any logical explanation?
I do not think we can offer anything logical that goes right down to the root cause, we are very short of infomation, and probably need a lot more from you
Your described behaviour says that your anti-virus is interfering. There is nothing wrong with it doing that, it's protective. But it sounds like something is inserting a virus into the file after you've downloaded it. This is nothing Atlassian software can do, it's something else on your machines.
I'm afraid this is not the case. I've tried this on multiple computers in multiple separated environments and accounts. I do not believe all of them will have same virus. If I upload same executable on any other http/s storage (for example to GitLab or Google Drive) and download back it is clean. We are running standalone JIRA (but as I mentioned same behavior occurs on cloud JIRA...).
To sum up all points to that it is changed by JIRA.... :|
Can you help me to identify where are attachments stored in JIRA so we can monitor if it is changed directly on storage/DB level?
More information about executable:
C# Windows form application (.exe) compiled without signing via Visual Studio.
P.S: I'm ok for live session where I can present the behavior and give you access to cloud Jira so you can download by yourself.
I'm sorry, but you exactly described a case where something is changing a file AFTER you've downloaded it from Jira. Specifically:
"Right after upload I downloaded and file was same.
However if I download file after 5-10 minutes, my antivirus (Defender) reported it contains Trojan:MSIL/Masslogger.VN!MTB"
If the file on your local machine is changing, it can not be the Server you downloaded it from. There is something on your machine changing it. Not Jira.
Even if I assume that your original report is not accurate, and the infection is actually happening on the Jira server, before download, you still have the problem that Jira has no code in it that writes to attachments. All it can do is copy an upload stream to the attachment directory, and serve up previews of attached files.
However, if the file really is being changed on the server, all that means is that your server has something on it that is infecting the files. Whatever that is though, it's not Jira.
You also say you are on Cloud - that rules out any looking at the attachments on the storage, but also, if a virus were present on the Cloud service and doing this, it would have been found and shut down a long time ago. If you are on Cloud, then it's an absolute fact that whatever is doing this is on your machines, not Jira.
For JSM June Challenge #2, share how your non-technical teams like HR, legal, marketing, finance, and beyond started using Jira Service Management! Tell us: Did they ask to start using it or...
Connect with like-minded Atlassian users at free events near you!Find an event
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no Community Events near you at the moment.Host an event
You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events