Malware issues continue after confluence security vulnerability addressed...

[Becky Kirk]

My environment was impacted by the security vulnerability introduced by Atlantis Confluence Security Advisory - 2019-03-20 https://confluence.atlassian.com/doc/confluence-security-advisory-2019-03-20-966660264.html?_ga=2.42850912.435297976.1555337817-950560266.1551278855&_gac=1.36301716.1552504971.EAIaIQobChMI-d6O2Ov_4AIVkoRpCh32zAEMEAAYASAAEgKqk_D_BwE

We followed the Atlassian provided troubleshooting steps to a T. Is anyone else continuing to experience fall out AFTER upgrading confluence? It seems the upgrade wasn't enough and we are continuing to experience malware issues in our environment.  

Are we alone? Please let me know.

[Craig Castle-Mead]

Hi Becky,

If your system was already infected prior to the upgrade, then just running the upgrade won't be enough unfortunately. There's been numerous examples where a system was compromised using the vulnerability, once the system was compromised, the bad actors then got their own software on those servers, so even with Confluence fixed, the other software was still running.

It's best practice (and in this case, pretty much a have to do) that if a system has been compromised that you setup a brand new installation on a clean server, carefully restore your data (database and home directory) - watch carefully that you're not pulling over infected files too, run your companies virus/etc over the data you restore and then closely monitor the new environment as well.

CCM