Script to find files following acymailing vulnerability

In the meantime, I prepared a code that may be able to list infected files, that you can add in the file administrator / components / com_acym / controllers / configuration / Listing.php in the function "listing":

$maliciousFiles = [];
$siteFiles = acym_getFiles(ACYM_ROOT, '.', true, true);
foreach ($siteFiles as $oneFileName) {
    $lastSlashPos = strrpos($oneFileName, '/');
    if (!empty($lastSlashPos) && strpos($oneFileName, ACYM_UPLOAD_FOLDER_THUMBNAIL) !== false && preg_match(
            '/.*thumbnail.*php.*$/',
            substr($oneFileName, $lastSlashPos + 1)
        )) {
        $maliciousFiles[] = $oneFileName;
    } elseif (filesize($oneFileName) < 10000) {
        $fileContent = file_get_contents($oneFileName);
        if (preg_match('/^<\?php\n\$[a-z]+\s*=\s*\$_COOKIE\s*;/Ui', $fileContent) || preg_match('/^<\?php echo "jm"\."te"\."st"; \?>$/U', $fileContent)) {
            $maliciousFiles[] = $oneFileName;
        }
    }
}

if (empty($maliciousFiles)) {
    acym_enqueueMessage('No malicious file detected', 'info');
} else {
    $message = 'Potentially malicious files detected:';
    $message .= '<ul><li>'.implode('</li><li>', $maliciousFiles).'</li></ul>';
    acym_enqueueMessage($message, 'error');
}

It should look like this:

Once done, a message should appear at the top of the AcyMailing configuration page which should look like this if it finds something:

This code only lists the files, it doesn't remove them.

Dax what I didnt get any email updates about this ??

This was the report:

array(11) {
[0]=>
string(103) "/./administrator/components/com_easyblog/includes/blocks/handlers/thumbnails.php"
[1]=>
string(115) "/./administrator/components/com_easyblog/themes/default/blogs/dialogs/restore.thumbnails.php"
[2]=>
string(109) "/./components/com_easyarticles/themes/wireframe/templates/dialogs/delete.thumbnail.php"
[3]=>
string(105) "/./components/com_easyblog/themes/wireframe/helpers/featured/slider/thumbnails.php"
[4]=>
string(90) "/./components/com_easysocial/themes/wireframe/photos/thumbnails.php"
[5]=>
string(102) "/./components/com_kunena/template/aurelia/layouts/attachment/item/thumbnail.php"
[6]=>
string(101) "/./components/com_kunena/template/system/layouts/attachment/item/thumbnail.php"
[7]=>
string(78) "/./media/com_acym/images/thumbnails/thumbnail_0.php.png"
[8]=>
string(80) "/./media/com_acym/images/thumbnails/thumbnail_199.php.png"
[9]=>
string(79) "/./media/com_acym/images/thumbnails/thumbnail_92.php.png"
[10]=>
string(74) "/./modules/mod_easyblogshowcase/tmpl/thumbnails.php"
}

Should I delete all those files?

or only these? string(78) "/./media/com_acym/images/thumbnails/thumbnail_0.php.png"
[8]=>
string(80) "/./media/com_acym/images/thumbnails/thumbnail_199.php.png"
[9]=>
string(79) "/./media/com_acym/images/thumbnails/thumbnail_92.php.png"

Do you have a patch for this that can replace the issue?

mihha
Dear Mihha,
To be honest, I think communicating through a blog post about this issue is not enough. Not everyone will read your blogs or are subscribed to them. You will have to approach the users really proactively. In addition, it would be to your company's credit if a patch also reports whether a component contains vulnerabilities. It would be even better if these vulnerabilities are automatically removed upon detection. I use your component for one month for one of my custormers. I am not yet convinced to advise my client to continue AcyMailing in the future. Please show us that you are a professional company that takes all the anxiety away from your clients. At this moment, there is still some room for improvement.

Dax

Thank you for the code. It worked fine to find the files. Actually, the provider sent almost the same results (minus 2 thumbnails) to warn me about a possible breach.

Coincidentally, I also got a notification in the AcyMailing Configuration area, saying "Duplicate column name 'image'" with today's date (screenshot attached):

Could that be related?

I checked the #__acym_... database tables and could not find a table with a duplicate column. The only column image was in a table #__acym_custom_zone. That table has 0 records, though. I am still checking the installer package to find out whether this is a native table, but maybe you have a hint.

Edit: OK, the table #__acym_custom_zone is apparently a genuine part of AcyMailing. Still wondering about the meaning of the notification and what it implies ...

Thanks

@mmaass Did you update from a version older than v7.9.4?
The "Duplicate column name image" message may show up when this new column already exists during an update (it mainly happens to us when doing tests on updates, but it can also happen when someone downgrades the version of AcyMailing then updates again).
In this case, the column isn't duplicated, it is an information message telling you that the update script couldn't create something that already exists.

Luckily I had Umify AV installed on my WHM and warned be immediately of this hack in the com_acym folders.
It started to affect the whole site and creating leaks at various places.
This tool located them all and was able to delete most of them quickly.
I checked each folder where they were located and found a few undeleted.

Dax Thank you

A - Would be good to add here (and in the Blog Article) for the download the "new" listing.php file

B - Would be good also to show a "Success" message when no auspicious infected files are not detected (so we know the script is running)