3

Weird things happening. I've written a customized product import script which is executed as a shell script. In this script, I gather some XML input, parse it into an array and then try to import the data using a custom class MD_ImportProduct_Model_Import extends Mage_Core_Model_Abstract

However, executing the class method, it dumps the source code of the class file rather than execute it. And then I see a fatal error "PHP Fatal error: Uncaught Error: Call to a member function setImportData() on boolean"

            $model = Mage::getModel('md_importproduct/xml_parser');
            $model->setXmlFilePath($file);
            $data = $model->getPairedData();
            Mage::getModel('md_importproduct/import')->setImportData($data)->execute();

What really freaks me out is when I run the script in my browser (or actually an isolated test case with just the app/Mage.php bootstrap and this line):

$md = Mage::getModel('md_importproduct/import');

It still dumps the class file contents and the following: 低�

Have I been hacked? The problem does not occur on a staging environment. There are no code differences in the custom model, so I assume the issue might be deeper inside the Mage core .. but I don't see any recently changed files or other obvious differences. I'm afraid I have no idea where to look ..

Why would the source code be dumped?

0

The short version of the answer is, of course, perhaps you have been hacked, but there’s not enough information provided to know for sure.

I have seen attackers insert replacements for some core files onto a compromised magento installation that dump source code (and, more importantly, configuration values like database logins and passwords which they can use to manually insert CMS block content into your database that will get injected into every page rendered by your site to, for example, skim credit card numbers used during checkout) instead of executing the source code.

Of course, in order to do this, they need to have already compromised your system so that they can upload files to your web server; but that is not necessarily very difficult to do, depending on your web server configuration and how up to date your security patches for your installed software happens to be.

I am also guessing that the Mandarin character that is being printed in your described test scenario output may be pushing you in the direction of thinking you might have been hacked, and that’s not an unwarranted deduction.

I’d recommend that you use one of the publicly available security scanner tools to check your production environment to see if it’s been compromised and verify that it is fully updated with all of the latest available security patches.

Some options I’ve used with success in similar situations include:

  • MageReport - great scanner and doesn’t require you to install any software on your system. This may be important because if you ARE hacked you will want to be able to capture an image of your system’s hard drive with as little changes as possible for forensic analysis. Depending on your local, regional and national laws (and the terms of your merchant processing agreement with your credit card processor), you may be required by law to make an an image of your system or preserve it intact when you contact law enforcement to report the incident.
  • MageScan - a great open source utility from Steve Robbins that does require installation on your system but can analyze some details that aren’t necessarily observable from an external scan.
  • You may also have the n98-magerun utility installed on your production system which you can enhance with the Magento Project Mess Detector extension to determine if any of your Magento Core files have been modified. While not technically a security scanner, per se, it’s a tool I use often when analyzing systems for security compromises. To avoid destroying any evidence which by law (or contract) you might be required to preserve for future forensic investigations, you will probably want to clone your production environment into a VM and run these tools against the clone, even if you happen to have them installed in your production systems (which is normally not a recommendation I make).

Finally, if you haven’t already done so, please make some time to review the Magento Security Best Practices Guide, which includes a lot of other useful information both for responding to situations like the one you face and (more importantly) preventing them from occurring in the first place. It contains content from many of the authors of the tools listed above (full disclosure : I was also a co-contributor) and it will provide you with additional suggestions of actions you should take to address the security questions you may face.

  • 1
    Also try eComscan to scrutinize your store for malware, backdoors and vulnerabilities. You can use it for free if you use the MWSCAN coupon. Disclaimer: I made Magereport & mwscan & eComscan ;) – Willem Oct 21 '19 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.