In Atlassian Confluence Server is found vulnerability through which intruders can upload malware programs

Cybercriminals actively use critical vulnerability in Atlassian Confluence Server for remote hacking of Linux- and Windows-servers.

The issue is in template injection in Widget Connector (CVE-2019-3396) that allows remote attacker to perform catalogue bypass and perform random code on settings of Confluence Server and Data Center.

Augusto II Remillano, security specialist from Trend Micro company, reports:

“This malware variant can perform DDoS attacks, remote code execution, and cryptocurrency mining on systems that run vulnerable versions of Confluence Server and Data Center. Atlassian already took steps to fix these issues and recommended that users upgrade to the latest version (6.15.1)”

Currently vulnerability has many exploits. First arrived on April 10, and cybercriminals immediately added it to their arsenal. Began mass scanning that searched from vulnerable settings Confluence Server and Data Center that aimed infecting them with extortionate software GandCrab.

After compromising a server, intruders on the controlled machine download a set of tools Empire PowerShell, with the use of it the upload achived GandCrab version. According to Alert Logic specialists, for bypassing is exploited CertUtil LOLBin.

Through the vulnerability CVE-2019-3396 intruders also install Dofloo malware. This malware program assists in uniting of large quantities of crashed servers in botnets for DDos-attacks (with the use of SYN, LSYN, UDP, UDPS and TCP – floods) and cryptocurrency mining.