Malicious files uploaded to server

Can you please confirm in which version this was addressed.

Was it 2.8.15, which has "Fixes bugs in MarkItUp editor" in the release log?

If so, it would definitely be worth including something a little more pressing in the release log, such as 'Addresses security vulnerability'. Users need to know there is a major vulnerability that allows a malicious user to upload a file, as this can (and, unfortunately, in this case, has) give that user full access to the server.

This is a serious vulnerability and users need to be alerted as such, so they know the importance of upgrading right away.

Thanks for removing the domain name and exact details of the file.

To let you know, the user managed to upload a .phtml file that contained pretty sophisticated PHP code. This script actually allowed them to carry out terminal/shell commands. Unfortunately this allowed them free reign to browse our server with ls commands in search of configuration files, which they found, thus giving them access to database details. They then used the same .phtml file to carry out a number of mysqldumps.

I don't know if you can natively use .phtml files in the same way as a .php file, or if our server is poorly configured and allowed a .phtml file to act in this way.

I don't have a reason to believe we were targeted specifically, so suspect someone is looking to make use of this vulnerability to target Perch sites, or other sites using the same editor.

I had a site that has just been hacked with this vulnerability as well. Just to add to the sense of urgency on this.

I checked my logs - they have been finding Perch sites by googling /perch/resources/ . I tried doing the same search, and immediately identified two websites (out of three I checked) that have been similarly compromised (the listing of the files shows the .phtml file named above).

I think this merits a message to Perch users telling them how to check if they've been compromised, to be honest.

Drew / Rachel - I've identified 9 sites that have also been hacked. Have sent you the details by email.

Yes, but that's not the same as notifying customers who have been hacked that their systems have been compromised.

Given that significant numbers of your customers have been hacked already, giving information on how to check whether or not this has happened to you would be a good idea - but certainly contact ones that have come to your attention as definitely hacked, surely?

I've updated all my Perch Runway sites (2.8.17) and updated the markitup editor, but it'd be reassuring to know how to check if any of them were compromised.

Are we just looking for a .phtml file in the /perch/resources/ folder?

Hi Stephen - yes, if there's a .phtml file, or any other executable file, in that folder it will indicate you've definitely been compromised. If not, you're probably OK. However, the script they use has a self-destruct facility to remove itself after it's installed a backdoor, so you might also want to go into the site raw logs for the last 24 hours and check for activity around the markitup folder, and anything that calls a phtml file.

So far, however, they seem to be leaving the file in place after they've been.

If you've been compromised, they'll almost certainly have done an sql dump of your database, so make sure you change all user passwords.

I've seen three working versions of this in the wild, one on my client's website.

If you see this file, click onto it in your web browser. If it works, you'll see a menu of options. At that point, assume your site has been compromised, notify your hosts and take action.

Have a look at the server logs and see what they did (the parameters are passed to the file as _GET variables).

If you click on the file and it doesn't do anything, then it should be ok.

None of the replies here gave any impression that it was being taken seriously. Good communication is hardly "just making noise".

I would like to thank Perch for taking this seriously. We have discovered that this is most likely the cause of several sites being recently compromised. The effect was files being placed that were then used as phishing targets, and a couple of attempts at trigger bulk emails from the server.

For around 10 days we've been suspecting WordPress was the cause - and have tightened up the security even more than usual (a good thing anyway). We never found the actual cause - until now. I just patched all our Perch installs (and upgraded around half of them before the patch came out). I then checked all /resources folders - and found a 'phtml' file in a site where the 'hosted' customer had added this as an allowed PHP extension. Now stopped, but at least we FINALLY found the cause it seems.

If anyone is interested, the exploit reads the Perch config file to get the database credentials. Not sure what it does/did with them next but we are restoring to an older backup as the client's not made any updates for quite a while.

Hi, is there a reason for all the individual version patches? Are we able just to upload the latest markitup?