Confluence Server doesn't work

[Sergey Kondakov]

When I've just started Confluence sever it works properly, but after 10-15 minutes it's starting some process which loading CPU to 100% and I can't to enter into web interface at all. At ssh console I see that JAVAE process under user confluence use all available CPU time.

[Hana Kučerová · Accepted solution]

Hi @Sergey Kondakov ,

please look like here, it seems to me it could be the same problem.

[Sergey Kondakov]

Maybe. I see that appear new executable script at /tmp/javac. Ive just delete it and change all passwords. Then openssh-server should be reinstalled there rise some problems with dependents. At this time problem solved. 

[Sergey Kondakov]

Ah and Oh. Today I've see that appears new malfunction process at tmp directory. T've killed administratively but it shows that Confluence has back door to place and run malfunction code at /tmp directory. 

[Hana Kučerová]

Hi @Sergey Kondakov ,

probably you need to apply the patch or upgrade your Confluence, see here.

[Daniel Ebers]

Hi @Sergey Kondakov

while patching the vulnerable Confluence installation alongside with removing the malicious crypto miner is the correct measure in first place you would need to assess if the server is compromised in a way it needs probably to be restored from backup.

Basically a machine got hacked like yours should not be trusted anymore. Please do a thorough check of the environment, too. The malware seen in that cases is reported to "jump" to other hosts, too.

Regards,
Daniel