Hey @Rakesh Kumar Srivastava ,
It looks like you are running Confluence 6.2.0 which is vulnerable to a malware attack we've seen in the wild. The symptoms you described match an active exploit that attacks the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20). We've seen attackers infect servers with malware that tries to mine bitcoin. The malware runs under the confluence system user account, consumes all the CPU, and relaunches itself every few minutes if you kill the process.
The first step in fixing this is upgrading Confluence. The latest releases are:
Secondly, the LSD malware cleanup tool will be useful for removing the Kerberods malware. I would recommend executing cleanup after upgrading Confluence to a patched version so there's no possibility of re-infection while you work on the upgrade.
Please let me know if you have more questions!
Daniel | Atlassian Support
Hi @Daniel Eads
After upgrading the version, It shows blank white screen.
When i see page source, following code is showing
<!DOCTYPE html> | |
<html> | |
<head> | |
<meta charset="utf-8"> | |
<style type="text/css"> | |
html, body, #partner, iframe { | |
height:100%; | |
width:100%; | |
margin:0; | |
padding:0; | |
border:0; | |
outline:0; | |
font-size:100%; | |
vertical-align:baseline; | |
background:transparent; | |
} | |
body { | |
overflow:hidden; | |
} | |
</style> | |
<meta content="NOW" name="expires"> | |
<meta content="index, follow, all" name="GOOGLEBOT"> | |
<meta content="index, follow, all" name="robots"> | |
<!-- Following Meta-Tag fixes scaling-issues on mobile devices --> | |
<meta content="width=device-width; initial-scale=1.0; maximum-scale=1.0; user-scalable=0;" name="viewport"> | |
</head> | |
<body> | |
<div id="partner"></div> | |
<script type="text/javascript"> | |
document.write( | |
'<script type="text/javascript" language="JavaScript"' | |
+ 'src="//sedoparking.com/frmpark/' | |
+ window.location.host + '/' | |
+ 'IONOSParkingUS' | |
+ '/park.js">' | |
+ '<\/script>' | |
); | |
</script> | |
</body> | |
</html> |
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Hi Rakesh,
This looks like the type of domain parking screen you see if your domain name registration has expired. Are you trying to access Confluence via a domain name (like "yourdomain.com") and is the registration for that site still valid?
You can check a domain's status by using the official ICANN whois tool.
Cheers,
Daniel
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
You should have a look at the logs, especially the atlassian-confluence.log or maybe also the Catalina.out to see what errors are logged there.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Following content is from Catalina.out
15-Apr-2019 10:23:38.404 WARNING [main] org.apache.tomcat.util.digester.SetPropertiesRule.begin [SetPropertiesRule]{Server} Setting property 'debug' to '0' did not find a matching property.
15-Apr-2019 10:23:38.599 WARNING [main] org.apache.catalina.startup.SetAllPropertiesRule.begin [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'debug' to '0' did not find a matching property.
15-Apr-2019 10:23:38.625 WARNING [main] org.apache.tomcat.util.digester.SetPropertiesRule.begin [SetPropertiesRule]{Server/Service/Engine} Setting property 'debug' to '0' did not find a matching property.
15-Apr-2019 10:23:38.638 WARNING [main] org.apache.tomcat.util.digester.SetPropertiesRule.begin [SetPropertiesRule]{Server/Service/Engine/Host} Setting property 'debug' to '0' did not find a matching property.
15-Apr-2019 10:23:38.720 WARNING [main] org.apache.tomcat.util.digester.SetPropertiesRule.begin [SetPropertiesRule]{Server/Service/Engine/Host/Context} Setting property 'debug' to '0' did not find a matching property.
15-Apr-2019 10:23:38.772 WARNING [main] org.apache.tomcat.util.digester.SetPropertiesRule.begin [SetPropertiesRule]{Server/Service/Engine/Host/Context} Setting property 'debug' to '0' did not find a matching property.
15-Apr-2019 10:23:39.499 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["http-nio-8090"]
15-Apr-2019 10:23:39.544 INFO [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read
15-Apr-2019 10:23:39.551 INFO [main] org.apache.catalina.startup.Catalina.load Initialization processed in 1284 ms
15-Apr-2019 10:23:39.582 INFO [main] org.apache.catalina.core.StandardService.startInternal Starting service Tomcat-Standalone
15-Apr-2019 10:23:39.583 INFO [main] org.apache.catalina.core.StandardEngine.startInternal Starting Servlet Engine: Apache Tomcat/8.0.41
15-Apr-2019 10:23:44.960 INFO [localhost-startStop-2] org.apache.catalina.core.ApplicationContext.log Spring WebApplicationInitializers detected on classpath: [com.atlassian.synchrony.proxy.SynchronyDispatcherServletInitializer@25a328d0]
15-Apr-2019 10:23:45.842 INFO [localhost-startStop-2] org.apache.catalina.core.ApplicationContext.log Initializing Spring FrameworkServlet 'dispatcher'
15-Apr-2019 10:23:45.857 INFO [localhost-startStop-2] org.springframework.web.servlet.DispatcherServlet.initServletBean FrameworkServlet 'dispatcher': initialization started
15-Apr-2019 10:23:45.889 INFO [localhost-startStop-2] org.springframework.web.context.support.AnnotationConfigWebApplicationContext.prepareRefresh Refreshing WebApplicationContext for namespace 'dispatcher-servlet': startup date [Mon Apr 15 10:23:45 UTC 2019]; root of context hierarchy
15-Apr-2019 10:23:46.126 INFO [localhost-startStop-2] org.springframework.web.context.support.AnnotationConfigWebApplicationContext.loadBeanDefinitions Registering annotated classes: [class com.atlassian.synchrony.proxy.websocket.WebSocketConfig,class com.atlassian.synchrony.proxy.web.SynchronyWebMvcConfig]
2019-04-15 10:23:46,691 INFO [localhost-startStop-1] [com.atlassian.confluence.lifecycle] contextInitialized Starting Confluence 6.2.0 [build 7111 based on commit hash 583f3f4010922d699723a091097524472954c767] - synchrony version 0.3.1-release-confluence_6.1-e20fb944
15-Apr-2019 10:23:47.878 INFO [localhost-startStop-2] org.springframework.scheduling.concurrent.ThreadPoolTaskScheduler.initialize Initializing ExecutorService 'defaultSockJsTaskScheduler'
15-Apr-2019 10:23:48.790 INFO [localhost-startStop-2] org.springframework.web.socket.server.support.WebSocketHandlerMapping.registerHandler Mapped URL path [/sockjs/v1/**] onto handler of type [class org.springframework.web.socket.sockjs.support.SockJsHttpRequestHandler]
15-Apr-2019 10:23:49.725 INFO [localhost-startStop-2] org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping.register Mapped "{[/healthcheck]}" onto public com.atlassian.synchrony.proxy.web.HealthCheckResult com.atlassian.synchrony.proxy.web.SynchronyProxyRestController.getSynchronyProxyInfo()
15-Apr-2019 10:23:49.727 INFO [localhost-startStop-2] org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping.register Mapped "{[/reload],methods=[PUT]}" onto public org.springframework.http.ResponseEntity com.atlassian.synchrony.proxy.web.SynchronyProxyRestController.reloadConfiguration(com.atlassian.synchrony.proxy.web.SynchronyProxyConfigPayload)
15-Apr-2019 10:23:49.803 INFO [localhost-startStop-2] org.springframework.web.servlet.handler.SimpleUrlHandlerMapping.registerHandler Mapped URL path [/**] onto handler of type [class org.springframework.web.servlet.resource.DefaultServletHttpRequestHandler]
15-Apr-2019 10:23:49.958 INFO [localhost-startStop-2] org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.initControllerAdviceCache Looking for @ControllerAdvice: WebApplicationContext for namespace 'dispatcher-servlet': startup date [Mon Apr 15 10:23:45 UTC 2019]; root of context hierarchy
15-Apr-2019 10:23:50.497 INFO [localhost-startStop-2] org.springframework.context.support.DefaultLifecycleProcessor.start Starting beans in phase 2147483647
15-Apr-2019 10:23:50.592 INFO [localhost-startStop-2] org.springframework.web.servlet.DispatcherServlet.initServletBean FrameworkServlet 'dispatcher': initialization completed in 4735 ms
2019-04-15 10:23:55,388 INFO [localhost-startStop-1] [atlassian.confluence.cluster.DefaultClusterConfigurationHelper] lambda$populateExistingClusterSetupConfig$1 Populating setup configuration if running with Cluster mode...
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
When i restart confluence then it automatically shut down after 4-5 seconds
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Online forums and learning are now in one easy-to-use experience.
By continuing, you accept the updated Community Terms of Use and acknowledge the Privacy Policy. Your public name, photo, and achievements may be publicly visible and available in search engines.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.