Malicious or unsafe files in MailChecker?

Mikenthuzi

Hi folks, I got a wordpress website and a flarum forum in https://maindomain.com/forums. I'm using wordfence plugin. I got a [Wordfence Alert], alert details are:

Critical Problems:

File appears to be malicious or unsafe: forums/vendor/fgribreau/mailchecker/platform/node/index.js

File appears to be malicious or unsafe: forums/vendor/fgribreau/mailchecker/platform/javascript/MailChecker.js

File appears to be malicious or unsafe: forums/vendor/fgribreau/mailchecker/platform/elixir/mail_checker.ex

File appears to be malicious or unsafe: public_html/forums/vendor/fgribreau/mailchecker/platform/go/mail_checker.go

File appears to be malicious or unsafe: forums/vendor/fgribreau/mailchecker/platform/ruby/mail_checker.rb

File appears to be malicious or unsafe: forums/vendor/fgribreau/mailchecker/list.txt

File appears to be malicious or unsafe: forums/vendor/fgribreau/mailchecker/platform/python/MailChecker.py

File appears to be malicious or unsafe: forums/vendor/fgribreau/mailchecker/platform/rust/src/lib.rs

File appears to be malicious or unsafe: forums/vendor/fgribreau/mailchecker/platform/php/blacklist.php

File appears to be malicious or unsafe: forums/vendor/fgribreau/mailchecker/platform/clojure/mailchecker.clj

flarum 1.8.9, php8.2

Flarum core: 1.8.9
PHP version: 8.2.27
MySQL version: 10.11.10-MariaDB
Loaded extensions: Core, date, libxml, openssl, pcre, sqlite3, zlib, bz2, calendar, ctype, curl, hash, filter, ftp, gettext, json, iconv, SPL, pcntl, random, readline, Reflection, session, standard, mbstring, shmop, SimpleXML, tokenizer, xml, bcmath, dom, fileinfo, gd, gmp, igbinary, imagick, imap, intl, exif, memcached, monarxprotect, msgpack, PDO, mysqlnd, mysqli, pdo_mysql, pdo_sqlite, Phar, posix, redis, soap, sockets, sysvmsg, sysvsem, sysvshm, tidy, timezonedb, xmlreader, xmlrpc, xmlwriter, xsl, zip, Zend OPcache
+-------------------------------------+---------+--------+
| Flarum Extensions                   |         |        |
+-------------------------------------+---------+--------+
| ID                                  | Version | Commit |
+-------------------------------------+---------+--------+
| flarum-flags                        | v1.8.2  |        |
| flarum-tags                         | v1.8.3  |        |
| flarum-approval                     | v1.8.2  |        |
| flarum-suspend                      | v1.8.4  |        |
| flarum-mentions                     | v1.8.5  |        |
| flarum-subscriptions                | v1.8.1  |        |
| flarum-sticky                       | v1.8.2  |        |
| flarum-likes                        | v1.8.1  |        |
| fof-pages                           | 1.0.8   |        |
| fof-byobu                           | 1.4.1   |        |
| fof-follow-tags                     | 1.2.8   |        |
| fof-user-directory                  | 1.4.0   |        |
| flarum-markdown                     | v1.8.1  |        |
| afrux-forum-widgets-core            | v0.1.7  |        |
| sycho-move-posts                    | v0.1.8  |        |
| clarkwinkelmann-author-change       | 1.0.3   |        |
| ziiven-daily-check-in               | v0.3.7  |        |
| v17development-user-badges          | v1.1.0  |        |
| v17development-seo                  | v2.0.5  |        |
| the-turk-stickiest                  | 3.0.1   |        |
| sycho-profile-cover                 | v1.3.5  |        |
| nearata-no-self-likes               | v1.2.1  |        |
| nearata-internal-links-noreload     | v2.2.0  |        |
| katosdev-signature                  | 1.6     |        |
| justoverclock-auto-post-count-badge | 1.0.0   |        |
| jslirola-login2seeplus              | v0.2.1  |        |
| huseyinfiliz-modern-footer          | v0.8    |        |
| fof-user-bio                        | 1.4.2   |        |
| fof-upload                          | 1.8.1   |        |
| fof-split                           | 1.1.1   |        |
| fof-socialprofile                   | 1.1.6   |        |
| fof-sitemap                         | 2.2.1   |        |
| fof-share-social                    | 1.2.0   |        |
| fof-realtimelogin                   | 1.0.1   |        |
| fof-reactions                       | 1.4.1   |        |
| fof-profile-image-crop              | 1.1.6   |        |
| fof-polls                           | 2.2.12  |        |
| fof-nightmode                       | 1.6.0   |        |
| fof-moderator-notes                 | 1.3.0   |        |
| fof-merge-discussions               | 1.4.1   |        |
| fof-links                           | 1.3.0   |        |
| fof-linguist                        | 1.1.5   |        |
| fof-geoip                           | 1.5.1   |        |
| fof-frontpage                       | 1.2.0   |        |
| fof-formatting                      | 1.0.3   |        |
| fof-drafts                          | 1.2.12  |        |
| fof-disposable-emails               | 1.0.0   |        |
| fof-discussion-language             | 1.3.6   |        |
| fof-default-user-preferences        | 1.2.1   |        |
| fof-cookie-consent                  | 1.1.3   |        |
| fof-best-answer                     | 1.6.3   |        |
| fof-anti-spam                       | 1.1.3   |        |
| fof-analytics                       | 1.1.0   |        |
| flarumtr-mobile-search              | v1.2    |        |
| flarumite-simple-spoilers           | 1.0.0   |        |
| flarumite-simple-discussion-views   | 1.2.4   |        |
| flarum-statistics                   | v1.8.1  |        |
| flarum-lock                         | v1.8.2  |        |
| flarum-lang-english                 | v1.8.0  |        |
| flarum-extension-manager            | v1.0.6  |        |
| flarum-emoji                        | v1.8.1  |        |
| flarum-bbcode                       | v1.8.0  |        |
| datlechin-silent-edit               | v0.1.0  |        |
| darkle-fancybox                     | 2.1.0   |        |
| club-1-cross-references             | v1.1.1  |        |
| clarkwinkelmann-mass-actions        | 1.1.2   |        |
| clarkwinkelmann-mailing             | 1.1.0   |        |
| clarkwinkelmann-emojionearea        | 1.0.0   |        |
| clarkwinkelmann-circle-groups       | 1.0.1   |        |
| blomstra-usercard-stats             | 0.1.2   |        |
| blomstra-fontawesome                | 0.1.5   |        |
| blomstra-cache-assets               | 0.5     |        |
| askvortsov-rich-text                | v2.1.7  |        |
| askvortsov-markdown-tables          | v1.2.1  |        |
| askvortsov-checklist                | v1.3.1  |        |
| afrux-forum-stats-widget            | v0.1.1  |        |
| acpl-mobile-tab                     | 1.4.5   |        |
| acpl-lscache                        | v3.3.1  |        |
+-------------------------------------+---------+--------+
Base URL: https://maindomain.com/forums
Installation path: /home/domains/maindomain.com/public_html/forums
Queue driver: sync
Session driver: file
Scheduler status: Never run
Mail driver: mail
Debug mode: off

Is this normal or malicious and unsafe? Please help. Thanks.

luceos

Can you type this in the root of your flarum install?

composer why fgribreau/mailchecker

Then post the output here.

Mikenthuzi

Thanks for prompt reply.

It comes out

fof/disposable-emails 1.0.0 requires fgribreau/mailchecker (^ 4.0.7)

Is that an extension version issue?

clarkwinkelmann

I am not familiar with Wordfence, but based on the files being flagged I assume it detected malicious domain names in those files, which would be expected as those contain lists of untrustworthy domain names to check Flarum email addresses against.

If it does detect malicious code, it would be interesting to get more details. Do they have a database of known vulnerabilities? Mailchecker doesn't seem to have any official CVE FGRibreau/mailcheckersecurity

Some code could also not be malicious but dangerous if left exposed to direct access. Make sure you blocked access to vendor/* through the provided .htaccess rewrite rules.

Mikenthuzi

clarkwinkelmann thanks for the advice, I just removed the extension temporarily.