Script to find files following acymailing vulnerability

mmaass

Mind that this is about the administrator part of the component. The path provided in Dax's post wraps to a new line after administrator so you might not have looked in "[root]/administrator/components/..." but in "[root]/components/...".

I first fell for that, too ... :-)

mmaass

Dax

Thank you for the code. It worked fine to find the files. Actually, the provider sent almost the same results (minus 2 thumbnails) to warn me about a possible breach.

Coincidentally, I also got a notification in the AcyMailing Configuration area, saying "Duplicate column name 'image'" with today's date (screenshot attached):

Could that be related?

I checked the #__acym_... database tables and could not find a table with a duplicate column. The only column image was in a table #__acym_custom_zone. That table has 0 records, though. I am still checking the installer package to find out whether this is a native table, but maybe you have a hint.

Edit: OK, the table #__acym_custom_zone is apparently a genuine part of AcyMailing. Still wondering about the meaning of the notification and what it implies ...

Thanks

Dax

@mmaass Did you update from a version older than v7.9.4?
The "Duplicate column name image" message may show up when this new column already exists during an update (it mainly happens to us when doing tests on updates, but it can also happen when someone downgrades the version of AcyMailing then updates again).
In this case, the column isn't duplicated, it is an information message telling you that the update script couldn't create something that already exists.

rvsafetyed

I learned of this issue of with an infected site warning from our https://mysites.guru account - site management and security tool. This security tool flagged one of the two files (two located so far) as a hacked file with malicious code.

rakesh

Luckily I had Umify AV installed on my WHM and warned be immediately of this hack in the com_acym folders.
It started to affect the whole site and creating leaks at various places.
This tool located them all and was able to delete most of them quickly.
I checked each folder where they were located and found a few undeleted.

joomleb

Dax
Thank you for you work. But I do not understand, Do we have to create the file ?
Why don't you added here the file to download ?
Why don't you added the file in the last AcyMailing 8.7.1 release ?

Dax

@joomleb The v8.7.1 has been released 13 days ago, the script didn't exist yet.
I'm preparing a v8.7.2 that will use it but it takes a bit more time to do and test than sharing the code here.

joomleb

Dax Thank you

A - Would be good to add here (and in the Blog Article) for the download the "new" listing.php file

B - Would be good also to show a "Success" message when no auspicious infected files are not detected (so we know the script is running)

gatomadrid

I added the lines as indicated i´ve got a blank page.

i delete these lines:

if (!empty($lastSlashPos) && strpos($oneFileName, ACYM_UPLOAD_FOLDER_THUMBNAIL) !== false && preg_match('/.*thumbnail.*php.*$/', substr($oneFileName, $lastSlashPos + 1))) { $infectedFiles[] = $oneFileName; } else { $fileContent = file_get_contents($oneFileName); if (preg_match('/^<\?php\n\$[a-z]+\s*=\s*\$_COOKIE\s*;/Ui', $fileContent) || preg_match('/^<\?php echo "jm"\."te"\."st"; \?>$/U', $fileContent)) { $infectedFiles[] = $oneFileName; } }

and it "worked" but i cannot obviously get a list of infected files. What can be wrong in these lines? I updated to Enterprise 8.7.1.

Thank you,

gatomadrid

IN my case i found manually a file created the 5th May. I deleted it. CAn be this file be realted to this vulnerability? Must i change passwords?

Dax

@joomleb
A - You're right it's easier to share the modified file, here it is: https://fromsmash.com/OjXHpg6gzz-ct
The link is available 13 days, but a new version should be released by then with an auto-cleaner.
B - I changed a bit the script to do that

@gatomadrid some file editors may automatically change the quotes when copy-pasting, could you use the file in my link to see if it works better?

joomleb

Dax
Would be good to add to the script also an automatic email reporting to you to collect statistics on all suspicious infected files...

Dax

There's a limit to what I can do with this script, we've got to release it at some point and each modification pushes back the release date.

gatomadrid

@Dax

I still have the same blank page although I downloaded from the link that you gave us. The error is in this part of the code because if i delted it i don´t get the message.

&& strpos($oneFileName, ACYM_UPLOAD_FOLDER_THUMBNAIL) !== false && preg_match(
'/.thumbnail.php.*$/',
substr($oneFileName, $lastSlashPos + 1)

What can be wrong? the variable ACYM_UPLOAD_FOLDER_THUMBNAIL is not empty. I delete the first parte ( strpos($oneFileName, ACYM_UPLOAD_FOLDER_THUMBNAIL) !== false ) and then the second part (preg_match(
'/.thumbnail.php.*$/',
substr($oneFileName, $lastSlashPos + 1))

and in both cases i still have the same error: Blan ppage. A problem with the variable $oneFileName?

Dax

It may have been because of scanned files size, I modified the script and the download link accordingly.

gatomadrid

Ahora si funciona. Gracias!

HDcms

Hi
I've just downloaded version 8.7.3.µwhere will I find the new button to test if acymailing is infected?

teddybear060470

You wrote you will have a solution in the next time to delete all the "new files". So let us know what to do after we found this files? And after we have change the passwords for the database and administrator of the website? What next ...

Can i delete the files?

When will be a solution?

Are we in danger with this files?

Kind regards
Anton

info@webkonturen.de

Today my webhoster informed me about potentially viruses in AcyMailing.
First of all, I never got any email notification about this security issue.
Reading this thread I really don't know, if there are still any viruses in my installation and if yes, what will they do.

Since I am not a coder I really expect YOU, the support, to give us some answers and an easy way to check the files and which php files should be deleted. I really don't want to crash my system by deleting the wrong php files.

Until now, I found 3 malicious files in the media/com_acym/images/thumbnails folder and deleted them. And I updated AcyMailing to the latest version.

So support, tell me, is there still something to do, better: what can you do to support your customers concerning this issue?

mihha

You should install the latest version (8.7.4) because we actually did something, and we provided a tool that will scan your entire site from the root folder and find all possible files that were injected because of the security hole that existed in AcyMailing

This is from our changelog

« Previous Page