XF 1.5 redir.php downloaded from my forum after logging in.

[1im]

I never had this issue before. After the first time, I cleared my cache as I thought it may have been some weird issue but I have received it again right afterwards. It happened after I logged into my forum.



I opened the file and it seems to have some sort of gif header.

 

[Jake Bunce]

Can you attach the file or is it too large?

 

[1im]

GIF89a € !ù , D ;

 

[1im]

Well can't attach, no php, no txt allowed. Can't add all uni characters in quote.

 

[1im]

www.afangame.com/dirty/redir.txt here you go @Jake Bunce

 

[1im]

I found out some more information about this thing.

It says the file came from 1024.xg4ken.com according to Microsoft Edge..



A link I found about some information. Could be related or unrelated..

xg4ken.com, XSS, CWE-79, CAPEC-86, Cross Site Scripting, DORK, Unforgivable Vulnerabilities

So now the real question: If my forum has been exploited and I am up to date with all updates, how do I remove this thing? =)

 

[Coop1979]

Do a search through your templates for anything with redir.php, or a string from the uni characters.

 

[1im]

Do a search through your templates for anything with redir.php, or a string from the uni characters.

which UNI chars? The one's in the file?

 

[Coop1979]

Yes. Also search through the files in your XenForo forum directory.

 

[Mike]

First step would be checking the file health check to see if anything appears there.

 

[1im]

First step would be checking the file health check to see if anything appears there.

No issue's there except showing no files in my install directory is there which is expected since I delete the directory after every install/update.

 

[Mike]

It could be injected at the server level (worth noting that I didn't see any requests for it when I loaded the page). In terms of XF, the best you can really do is ensure there aren't any unexpected files (which won't be checked by the file health check, though they won't be loaded automatically) and rebuild the master data via /install/. Ideally, you'd want to restore a backup (files and database) from prior to the issue occurring to ensure nothing is untoward.