Security threat in v150626

  • Resolved Tamenori

    (@tamenori)


    10 years, 10 months ago

    Hello,

    Since the v150626 update , VaultPress detects a security threat in the following file :
    /wp-content/plugins/zencache/src/vendor/websharks/html-compressor/src/includes/classes/Core.php
    Lines 670 and 1435.

    Warning message is :
    PHP.Shell.Encoded.1
    VaultPress has detected a web-based “shell” a very dangerous backdoor which may allow unauthorized access to your server.

    Should I ignore this warning ?

    Regards,
    Tamenori

    https://wordpress.org/plugins/zencache/

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author Raam Dev

    (@raamdev)

    10 years, 10 months ago

    @tamenori

    This is what is on those two lines:

    '(?P<script_open_tag>\<script(?:\s+[^>]*?)?\>)(?P<script_js>.*?)(?P<script_closing_tag>\<\/script\>)'.

    And that line is part of a bigger collection of RegEx’s, used to search for JavaScript fragments during JS Compression (a feature of the ZenCache HTML Compressor):

    $regex = '/(?P<all>'.// Entire match.
                 '(?P<if_open_tag>\<\![^[>]*?\[if\W[^\]]*?\][^>]*?\>\s*)?'.
                 '(?P<script_open_tag>\<script(?:\s+[^>]*?)?\>)(?P<script_js>.*?)(?P<script_closing_tag>\<\/script\>)'.
                 '(?P<if_closing_tag>\s*\<\![^[>]*?\[endif\][^>]*?\>)?'.
                 ')/is'; // Dot matches line breaks.

    None of that is actually a PHP shell, or anything malicious. It looks like VaultPress is incorrectly detecting that code as a “shell” when in fact it’s not. (This is known as a ‘false positive’; you can let VaultPress know about the issue and hopefully they fix their next update so that it doesn’t detect ZenCache as being malicious.

    Let me know if you have any other questions. 🙂

    Plugin Author JasWSInc

    (@jaswsinc)

    10 years, 10 months ago

    Referencing: https://github.com/websharks/zencache/issues/516

    Thread Starter Tamenori

    (@tamenori)

    10 years, 10 months ago

    Thank you guys, you rock !

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘Security threat in v150626’ is closed to new replies.