Script to find files following acymailing vulnerability

hanssie

mihha
Dear Mihha,
To be honest, I think communicating through a blog post about this issue is not enough. Not everyone will read your blogs or are subscribed to them. You will have to approach the users really proactively. In addition, it would be to your company's credit if a patch also reports whether a component contains vulnerabilities. It would be even better if these vulnerabilities are automatically removed upon detection. I use your component for one month for one of my custormers. I am not yet convinced to advise my client to continue AcyMailing in the future. Please show us that you are a professional company that takes all the anxiety away from your clients. At this moment, there is still some room for improvement.

serge

Dax I do not find a configuration folder, just a file

mmaass

serge

Mind that this is about the administrator part of the component. The path provided in Dax's post wraps to a new line after administrator so you might not have looked in "[root]/administrator/components/..." but in "[root]/components/...".

I first fell for that, too ... :-)

Dax

ssnobben The ones under media/com_acym/images/thumbnails/ yes, the other ones seem legit so don't remove them.
I edited the detection code to also check for the file content. It will take a bit more time to execute as it scans every file.

@hanssie We did also send multiple emails about the vulnerability, in addition to the article. Preparing a patch that removes files on client websites has to target with a 100% accuracy, it would be worse if such a code would remove legit files.
We're preparing one but it takes time to test it.

@serge You may not have the latest version of AcyMailing installed, we recently split our controller files into multiple ones to ease the maintenance on them.

mmaass

Dax

Thank you for the code. It worked fine to find the files. Actually, the provider sent almost the same results (minus 2 thumbnails) to warn me about a possible breach.

Coincidentally, I also got a notification in the AcyMailing Configuration area, saying "Duplicate column name 'image'" with today's date (screenshot attached):

Could that be related?

I checked the #__acym_... database tables and could not find a table with a duplicate column. The only column image was in a table #__acym_custom_zone. That table has 0 records, though. I am still checking the installer package to find out whether this is a native table, but maybe you have a hint.

Edit: OK, the table #__acym_custom_zone is apparently a genuine part of AcyMailing. Still wondering about the meaning of the notification and what it implies ...

Thanks

Dax

@mmaass Did you update from a version older than v7.9.4?
The "Duplicate column name image" message may show up when this new column already exists during an update (it mainly happens to us when doing tests on updates, but it can also happen when someone downgrades the version of AcyMailing then updates again).
In this case, the column isn't duplicated, it is an information message telling you that the update script couldn't create something that already exists.

rvsafetyed

I learned of this issue of with an infected site warning from our https://mysites.guru account - site management and security tool. This security tool flagged one of the two files (two located so far) as a hacked file with malicious code.

rakesh

Luckily I had Umify AV installed on my WHM and warned be immediately of this hack in the com_acym folders.
It started to affect the whole site and creating leaks at various places.
This tool located them all and was able to delete most of them quickly.
I checked each folder where they were located and found a few undeleted.

joomleb

Dax
Thank you for you work. But I do not understand, Do we have to create the file ?
Why don't you added here the file to download ?
Why don't you added the file in the last AcyMailing 8.7.1 release ?

Dax

@joomleb The v8.7.1 has been released 13 days ago, the script didn't exist yet.
I'm preparing a v8.7.2 that will use it but it takes a bit more time to do and test than sharing the code here.

joomleb

Dax Thank you

A - Would be good to add here (and in the Blog Article) for the download the "new" listing.php file

B - Would be good also to show a "Success" message when no auspicious infected files are not detected (so we know the script is running)

gatomadrid

I added the lines as indicated i´ve got a blank page.

i delete these lines:

if (!empty($lastSlashPos) && strpos($oneFileName, ACYM_UPLOAD_FOLDER_THUMBNAIL) !== false && preg_match('/.*thumbnail.*php.*$/', substr($oneFileName, $lastSlashPos + 1))) { $infectedFiles[] = $oneFileName; } else { $fileContent = file_get_contents($oneFileName); if (preg_match('/^<\?php\n\$[a-z]+\s*=\s*\$_COOKIE\s*;/Ui', $fileContent) || preg_match('/^<\?php echo "jm"\."te"\."st"; \?>$/U', $fileContent)) { $infectedFiles[] = $oneFileName; } }

and it "worked" but i cannot obviously get a list of infected files. What can be wrong in these lines? I updated to Enterprise 8.7.1.

Thank you,

gatomadrid

IN my case i found manually a file created the 5th May. I deleted it. CAn be this file be realted to this vulnerability? Must i change passwords?

Dax

@joomleb
A - You're right it's easier to share the modified file, here it is: https://fromsmash.com/OjXHpg6gzz-ct
The link is available 13 days, but a new version should be released by then with an auto-cleaner.
B - I changed a bit the script to do that

@gatomadrid some file editors may automatically change the quotes when copy-pasting, could you use the file in my link to see if it works better?

joomleb

Dax
Would be good to add to the script also an automatic email reporting to you to collect statistics on all suspicious infected files...

Dax

There's a limit to what I can do with this script, we've got to release it at some point and each modification pushes back the release date.

gatomadrid

@Dax

I still have the same blank page although I downloaded from the link that you gave us. The error is in this part of the code because if i delted it i don´t get the message.

&& strpos($oneFileName, ACYM_UPLOAD_FOLDER_THUMBNAIL) !== false && preg_match(
'/.thumbnail.php.*$/',
substr($oneFileName, $lastSlashPos + 1)

What can be wrong? the variable ACYM_UPLOAD_FOLDER_THUMBNAIL is not empty. I delete the first parte ( strpos($oneFileName, ACYM_UPLOAD_FOLDER_THUMBNAIL) !== false ) and then the second part (preg_match(
'/.thumbnail.php.*$/',
substr($oneFileName, $lastSlashPos + 1))

and in both cases i still have the same error: Blan ppage. A problem with the variable $oneFileName?

Dax

It may have been because of scanned files size, I modified the script and the download link accordingly.

gatomadrid

Ahora si funciona. Gracias!

« Previous Page