We are facing similar issue for two of our websites where products table are getting removed at random intervals and some suspicious files are getting created in document root. Affected Magento version is 2.4.8. The malware infection had unfortunately removed all of the product records from the database, although the categories and media files were unaffected. catalog_product_entity table was found completely empty. We could see some files every where in the document root File names filefuns.php was found in all most all pub folders. See the list of infected files identified and their locations. https://limewire.com/d/oaEOs#zULGFQXSG7 Even .htaccess file was found modified with a set of rules. Highlighted the same in the screen shot.
I have done a detailed investigation of the same and what i understand is a PolyShell attack.
Evidence found :
- pub/media/custom_options/quote/s/e/sergei_390836.php
- multiple php webshells in pub/media/custom_options/quote/
- a hidden nested pub/images/images/images/ directory with cache.php
- an infected pub/health_check.php,
- suspicious root-level pub/a3d18861c4dd.php.
I have took https://sansec.io/research/magento-polyshell as a reference and checked the site files again.
- I could see several access to infected and non-existing files from an IP (162.159.113.0/24) from the list of IP addresses mentioned
on the above doc!- Searched the list of file names mentioned across the document root and found the following infected files still there in the
document root.
I have done manual clean up and configured auditd in the hosting server to see the source if a new file like this get created. The very next day, malware files were found created again
but this time, DB data was not found removed.
Anonymous user is uploading files using “https://webxxxxx.com.co.uk/customer/address_file/upload”. The upload link now shows 404 not found error. But when the attacker accessed the link it somehow worked and throwed a 500 error most probably after php execution.
I have found several infected files in the account including ./pub/a3d18861c4dd.php. According to auditd, that file was created exactly on 18-07-26 at 01:50:25. In the apache access log, the following request was made from one of the attack observed IP address 141.101.98.167:
PUT /rest/V1/guest-carts/172/order
https://webxxxxx.com.co.uk/customer/address_file/upload
In the auditd log file some changes noticed in “media/customer_address/s/e/sess_xhra9mhp6setxga35eua5nuc1glxuqmv” just before the “./pub/a3d18861c4dd.php” file creation.
Seems this is sessionreaper https://sansec.io/research/sessionreaper
Has anyone else observed the catalog_product_entity table being completely wiped by this specific PolyShell/SessionReaper campaign? Is this intentional sabotage, or a symptom of a failed malicious SQL injection attempt?
Which specific Adobe security patches or hotfixes address the /customer/address_file/upload and guest-carts session weaponization for Magento 2.4.8?
