Possible CWP Security Issue – Malicious JavaScript Injection

For a while, I’m going to check the `/home` directory daily for files modified within the last 24 hours. Since my server has relatively few users but receives a high number of attacks, I’m more likely to notice suspicious activity. If I find anything suspicious, I’ll share it here.

This is the command I’m using:

Code: [Select]

find /home -type f -cmin -1440
-printf '%TY-%Tm-%Td %TH:%TM:%TS %p\n' 2>/dev/null |
grep -v 'sess_' |
sort -r

(...)

Same issue here, with Iang.php and ur1.php files.

What's the fix for these attacks? Just delete files?
Was not clear if this was created using FileManager vulnerability. Is this correct?

Various sites affected here.
Backups was disabled too, withoout any command.
Some Nodejs apps was down too, no reason.

Distro is Centos 8 Stream.


Thanks!

The issue lay with the file manager. The attacker used the DELETE method to send a request containing a long string, appended a semicolon (";"), and executed a series of commands with root privileges. I was able to confirm—based on the attack timestamp, the timestamps of the injected files, and log entries the attacker failed to delete—that this was the method used.

Therefore, you should restrict the DELETE method by adding the following configuration to your `/usr/local/cwpsrv/conf/cwpsrv.conf` file, placing it between the `server {` and `location / {` directives:

Code: [Select]

# Natively block unauthorized methods in NGINX
if ($request_method !~ ^(GET|HEAD|POST)$ ) {
        return 444; # Code 444 closes the connection immediately without sending headers, saving bandwidth and dropping the bot
}

Additionally, you should disable the file manager:

Code: [Select]

mv /usr/local/cwpsrv/var/services/user_files/modules/filemanager.php{,.disabled}

The attacker exploited the file manager to gain root access to the server using a standard user account. Consequently, you should also remove the following configuration block wherever it appears:

Code: [Select]

location ~ ^/~(.+?)(/.*)?$ {
        internal;
        proxy_pass http://IP.AD.DR.ESS:8181;
        include proxy.inc;
}

However, there is no guarantee that it did not access your information and collect any sensitive or confidential data from your server. You should take measures to mitigate the impact of the server data compromise, should such an event have occurred.

Regards,
Netino