Security Vulnerability?

I am only somewhat new to being a webmaster and am relatively new to the modX cms, and every issue I’ve had for the past few months I have been able to fix - until now. I’m in a bit of a dilemma; I recently discovered some mysterious files that were uploaded into my assets/images directory without my authorization. Opening one PHP file revealed incomprehensible strings of text - it started with the phrase "gzip," so I’m positive the characters following were encrypted in some way. Also in the same directory was a file that had a link to some viagra site. Scanning my other directories, I also found an entire directory named "/.css" - in the includes directory that contained scores of files named something like "free-automobile-something-or-other." Then recently I discovered another directory named "viagra" containing html and php files in my assets/images/icons/ directory. What is going on?! I only have one account on modX, and that’s the passworded admin user, so I don’t see how anyone could just go and upload via the modX content manager. The FTP server is also password-protected, so it couldn’t have been that either. Help?

Hello,

I think you will find your answer here: http://modxcms.com/forums/index.php/topic,30875.0.html

AMDbuilder

Thanks a ton! I’ve gone ahead and changed the file extension

After reading the original forum thread (linked from the official security thread: http://modxcms.com/forums/index.php/topic,30850), I also learned that $register_globals has to be on, but my server admin says it’s off. He also checked logs in November and found nothing with the snippet.reflect.php file, (though the first few files above were found with a modified date in October).

It doesn’t look like it’s the reflect issue because $register_globals was set to off... is there anything else that might have allowed a third party to upload content directly to the server?

Quote from: liurr90 at Dec 10, 2008, 03:15 PM

It doesn’t look like it’s the reflect issue because $register_globals was set to off... is there anything else that might have allowed a third party to upload content directly to the server?

Don’t trust your admin to tell you that register_globals is set to OFF; verify it yourself (open the Manager and choose Reports -> System Info and then click the phpinfo() link. Do a Find on Page for "register_globals". The Local Value should be OFF.).

Also: Did he check the server logs for December? It might have just happened. You should search the logs for one of the files or directories that has been created (e.g., "viagra"), since that would give you a clue as to how it got there.

Other than that I would look in Reports -> Manager Actions and see if someone logged into the Manager at some point to do any of this. I think it’s more likely that your FTP or Control Panel login was stolen or phished somehow. You’re not on IX Webhosting, are you?

Sad.

If you have register_globals off it seems they could have got their hands on your password for either modx, ftp or control panel.
Maybe through a trojan.

If you’re using MODX <9.6.2 it could be:
http://modxcms.com/forums/index.php/topic,21290.msg135206.html#msg135206

This is a great advice from here: http://modxcms.com/forums/index.php/topic,31288.msg189711.html#msg189711

Thanks for all the responses guys, I appreciate it!

I would like to check phpinfo() to make sure, but the server has been taken down in response to the "attack." I’m not on IX Webhosting - the server is local and maintained on-campus, just not in my building. We don’t have Control Panel, either - but obtaining and using the password for MODx or ftp is plausible.

I am using version 0.9.6.1, but the previous webmaster said he had MODx all patched up prior to August.