[Not malware] Potential malware in reflar extensions

[deleted]

Guys,

See below - just popped up in my alerts

FILE HIT LIST:
{HEX}php.exe.globals.411 : /var/www/vhosts/infosecforge.io/discuss.infosecforge.io/vendor/reflar/twofactor/scripts/PreCommit.php
===============================================
Linux Malware Detect v1.6.4 < proj@rfxn.com >

Any thoughts ?

Sanguine

[deleted] can you share the contents of that file? Did Maldet previously think this file was ok? If so, then either its signatures have changed, or the file has changed.

[deleted]

Sanguine will upload in a bit. Still working through a scan but it looks like there may be more

[deleted]

Now this in another forum with the legacy reflar polls extension

FILE HIT LIST:
{HEX}php.exe.globals.411 : /var/www/vhosts/guruwall.com/discuss.guruwall.com/storage/composer-home/cache/files/reflar/polls/f69bc16909d44cdbdd6cf3bb8fb64e316bc37e2b.zip => /usr/local/maldetect/quarantine/f69bc16909d44cdbdd6cf3bb8fb64e316bc37e2b.zip.2943011361
{HEX}php.exe.globals.411 : /var/www/vhosts/guruwall.com/discuss.guruwall.com/storage/composer-home/cache/files/reflar/gamification/d20d0c08eab7e70f40afc77b1b62741926d55575.zip => /usr/local/maldetect/quarantine/d20d0c08eab7e70f40afc77b1b62741926d55575.zip.78635886
{HEX}php.exe.globals.411 : /var/www/vhosts/guruwall.com/discuss.guruwall.com/storage/composer-home/cache/files/reflar/twofactor/924b402b97cab38d9a450dd43b52af0e7bfade2b.zip => /usr/local/maldetect/quarantine/924b402b97cab38d9a450dd43b52af0e7bfade2b.zip.816914655
{HEX}php.exe.globals.411 : /var/www/vhosts/guruwall.com/discuss.guruwall.com/vendor/reflar/twofactor/scripts/PreCommit.php => /usr/local/maldetect/quarantine/PreCommit.php.1859820973
{HEX}php.exe.globals.411 : /var/www/vhosts/phenomlab.com/.cache/composer/files/reflar/twofactor/924b402b97cab38d9a450dd43b52af0e7bfade2b.zip => /usr/local/maldetect/quarantine/924b402b97cab38d9a450dd43b52af0e7bfade2b.zip.1641013347
===============================================
Linux Malware Detect v1.6.4 < proj@rfxn.com >

Ralkage

[deleted] hi, this was already previously reported in another one of our extensions. This was a developer related file that @Kyrne created himself when he was developing our extensions. This file was also removed from polls and the same will happen as soon as we transition the rest of our extensions over to the FriendsOfFalrum space.

Sorry for the inconvenience 🙂

And also, if you are using older versions of our extensions that have this file due to lack of you updating them or just not updating Flarum itself I would advise that you disable them for now. Unfortunately, any future updates to our extensions that are currently incompatible will be examined whether or not we want to update to the latest Flarum beta or just simply abandon it. This also includes extensions that we would like to keep maintaining and move them to the FriendsOfFlarum namespace.

[deleted]

Ralkage And also, if you are using older versions of our extensions that have this file due to lack of you updating them or just not updating Flarum itself I would advise that you disable them for now.

Thanks. In actual fact, I have an open issue concerning the polls extension that already moved to fof - @luceos and @datitisev were looking into this but the issue remains unsolved. I'll disable these extension for now as you suggest. However, any ideas as to when twofactor will be migrated to fof ?

[deleted]

Ralkage Sorry for the inconvenience

No issues. Just wanted to be sure there's nothing "nasty" going down 😁

Ralkage

[deleted] please ping me the link to the issue on Discord and I'll take look 🙂

[deleted] nothing nasty whatsoever, I actually thought out my response this time around so that it would be as transparent and understanding as possible 😆

Also, it was probably flagged because this file calls the PHP exec() function which when executed can execute external programs such as git and php themselves along with any options specificed.

@Sanguine if you also have any concerns, please feel free to disable Two-factor as well until we can release an patch with this dev file removed 🙂

Edit: To add, this file along with the script folder does not exist in any of our other extensions anymore (both ReFlar and FoF).

Kyrne

[deleted] here is the exact file if you'd like to take a look: https://github.com/ReFlar/twofactor/blob/master/scripts/PreCommit.php

The purpose is to make enforcing our coding standards easier by automatically applying them when pushing to GitHub.