MODx Hacking Vulnerabilities: Permissions?

So after my site got hacked using a Javascript exploit that redirected 1st time visitors to a malware site, I’m asking myself how they got in (and what all I have to rebuild).

Possible Ways they got in:
1. Brute-force attack of my SSH login. Possibly, but I used a fairly complex non-dictionary password.
2. Hacked my MODx manager password. This is a more likely scenario.
3. Took advantage of loose 777 permissions on some directories. I don’t know how this is exploited, but...

From what I can tell, none of my php files were changed, only a single Javascript file was altered, and none of the other domains on the host were affected (from what I can tell), so I’m entertaining the idea that it was not #1.

What other vulnerabilities could lead to a user altering a Javascript file?

Which Javascript file was altered, and how? If they brute force hacked into your manager, and depending on how your server runs, the file manager could have potentially been used to alter any file.

What version of MODx are you running?

I’m running MODx 0.9.6.3, and I fell victim to this attack:
http://blog.unmaskparasites.com/2009/06/22/gstats-cn-and-gcounter-cn-malicious-code-in-js-files/

But that gcounter thing is more the payload, and I’m trying to understand how it got onto my site. The file that was modified was /assets/js/c_smartmenus.js (which I’ve deleted).

This MODx exploit looks plausible...
http://osvdb.org/show/osvdb/39957

A direct manager login is also plausible.

If you’re running 0963, then the exploit shouldn’t have been applicable. Had it been upgraded with the legacy files remaining in place?

I think this was installed directly as 0.9.6.3. Any particular files you were thinking of? I deleted the Reflect snippet due to its exploit.

The exploits mentioned in that advisory were for versions prior to 0963. Is MODx the only thing running on the server?

No, some of my other domains are running WordPress.

I had something similar happen to a non modx site a while back...turned out that it was related to a 3rd party payment gateway cgi script that had been hacked. I have also heard of js hacks coming from twitter feeds and remote banner/adds. I am curious to know what you find out about this...keep us posted.

Check your hosting. It’s more likely that they attacked your server from another app. RoundCube is a webmail app and it had a stupid vulnerability that caused a lot of servers to be hacked. Like you, it was just one file.

Yeah, I’m leaning towards a script vulnerability attack more than anything else... I didn’t see anything funny in my bash logs, or in MODx manager logs, but that’s not DISPROVING anything.

I do have RoundCube running on more than one domain there... I just think it’s time that I get my own virtual server so I can lock it down to my own specs. Bluehost wasn’t really pleased when I pointed out that fixing script vulnerabilities were moot when an SSH login can’t be locked down on a shared host.

There is no silver bullet, unfortunately... security is a process, and sometimes a painful one.