Page 1 of 10

[UPGRADE AVAIL.] ExtCalendar Vulnerability

Posted: Sun Jul 09, 2006 2:38 am
by bransonj
anyone know how this component was hacked?  Here are google results of other sites that have been hacked the same way: http://www.google.com/search?hl=en&lr=&q=irc.dal.nyet

Any info on this would be greatly appreciated!

MOD EDIT: Please see the link below for the post about the update.  -RobS
http://forum.joomla.org/index.php/topic ... #msg402249

Re: ExtCalendar

Posted: Sun Jul 09, 2006 6:56 pm
by friesengeist
FYI:
ExtCalendar Module for Mambo "mosConfig_absolute_path" File Inclusion Vulnerability
http://www.frsirt.com/english/advisories/2006/2711
edit: corrected url, don't know why last number was missing just by copy and paste ???

Re: ExtCalendar

Posted: Mon Jul 10, 2006 8:19 am
by albi
Any news from the developer?

Re: ExtCalendar

Posted: Mon Jul 10, 2006 8:39 am
by infograf768
THis issue has also been forwarded to the devs here.

Hacked site by ext calendar ?

Posted: Mon Jul 10, 2006 12:48 pm
by toemik
A site that I built for a friend has just been hacked by someone claimed to necromance, they had basically replaced the configuration file with their own page. - I will look elsewhere but  I will trash the site and rebuild rather than recover and run the risk that something else is there.

I was puzzled how, but fortunatly I run a number of web logging progams which may reveal the route

They used a search via Yahoo to look for the string "Powered By ExtCalendar" that is the only page I can track.
My method was to note the timestamp of the file and compare to my logs, that was the only entry. The text left on the site was Turkish and lo and behold a visitor left a Tuirkish  IP and Hostname - not 100% sure where to go with this, but looks pretty convincing to me.

Any after a data of some stuff, its building a new site.

FYI
Joomla 1.0.10
Not sure on Ext Cal version
We have users on the site but no one is allowed to upload anything nor put entries into the calendar
Only user input  is via a message board to registered users, I have removed the contac form as personally I believe there is a security issue with that (previously posted)

Re: Hacked site by ext calendar ?

Posted: Mon Jul 10, 2006 12:52 pm
by RobS
Toemik, could you please PM me the relevant log information for review.  Please don't publish it here.

Re: Hacked site by ext calendar ?

Posted: Mon Jul 10, 2006 1:26 pm
by toemik
sent va conact on your website

Re: ExtCalendar

Posted: Mon Jul 10, 2006 1:27 pm
by codlord
2 of my joomla sites were recently hacked via extcal2. Looks like some sort of code injection which allows modification of configuration.php???

Luckily I have regular site/db backups so just gotta delete/restore (and remove extcal I guess  >:( )

Dunno if its any use but some bits of the apache log relating to the hack (my site replaced with zzzzzz):



REMOVED FOR SECURITY.
Please do not post these calls publicly.

Re: ExtCalendar

Posted: Mon Jul 10, 2006 1:29 pm
by nathandiehl
FYI,

ExtCal2 hasn't been developed in like 2 years. i wasn't expecting it to be ported to 1.5 anyway, so i am going to switch calendars.

and i got hacked, too. The hack was 6 server calls in a matter of 26 seconds, so it certainly seems to be automated, and probably widespread.

also FYI,
the root index.php file was replaced, but the fix was simply to re-upload a new index.php file (from a new install).

Re: ExtCalendar

Posted: Mon Jul 10, 2006 2:11 pm
by infograf768
We are expecting a fix for ext_calendar as the developper is no more active.
We will post here.

Re: ExtCalendar

Posted: Mon Jul 10, 2006 3:00 pm
by danialt
Put the

defined('_VALID_MOS') or die('Direct Access to this location is not allowed.');

on the top of extcalendar.php..

It is a high level risk hole.

Re: ExtCalendar

Posted: Mon Jul 10, 2006 3:02 pm
by RobS
From the information I have received about the com_extcalendar (com_extcal2) vulnerabilities, there are currently two flavors of the exploit circling around.  To make matters worse, this component is no longer actively developed hence we don't expect a proper patch to come around soon enough to be effective so I can only recommend that you migrate to a newer/more actively developed calendar component.  For those that need time to do this type of thing, I have added another mod_rewrite condition to the ruleset I have been developing that will hopefully address the exploits that are going around (one version was actually already blocked by my mod_rewrite rule set, I like good surprises!)

If you would like to go this route, you can find the mod_rewrite rules in this thread http://forum.joomla.org/index.php/topic,75376.0.html 

Also, Elpie noticed that the vulnerability is caused by a lack of valid component checking that all Joomla files are supposed to do before they execute any code.  The code below should be in every 3rd party component file.

Code: Select all

// no direct access
defined( '_VALID_MOS' ) or die( 'Restricted access' );
Another option for those of you that need time to migrate away from com_extCalender would be to manually insert those two lines of code toward the top (but underneat the first comment chunk that starts with /* and ends with */ ) of all the files that were installed by com_extCalender in the /path/to/Joomla/components/com_extcalender/ and /path/to/Joomla/administrator/components/com_extcalender/ directories.  That will be a rather labor intensive project though because there are quite a few files and I cannot guarantee that addition will fix the problem all together.

Re: Hacked site by ext calendar ?

Posted: Mon Jul 10, 2006 3:16 pm
by chrpeder
I have had a similar experience with a site that was hacked and defaced. It seems it was hacked via extcalendar.

Re: ExtCalendar

Posted: Mon Jul 10, 2006 3:35 pm
by nathandiehl
MOD NOTE: EXT Threads merged.
Please look for an existing thread before starting a new thread. Thanks!

Re: Hacked site by ext calendar ?

Posted: Mon Jul 10, 2006 5:15 pm
by albi
RobS wrote: Toemik, could you please PM me the relevant log information for review.  Please don't publish it here.
I sended logfiles

Re: ExtCalendar

Posted: Mon Jul 10, 2006 9:14 pm
by RobS
That email address is not valid anymore.  I have PMed you a new one.

Re: ExtCalendar

Posted: Tue Jul 11, 2006 12:11 am
by countryboy
My version of extCalendar2 has a simliar "// no direct access
defined( '_VALID_MOS' ) or die( 'Restricted access' );
" statement in the file. 

What file has the "Powered by extCalendar" text?  I can't find it and at least thought I should delete that reference.

Anyone know of a good calendaring program to change over to?

Re: ExtCalendar

Posted: Tue Jul 11, 2006 12:22 am
by RobS
Which file are you referring to?  The component installs quite a few files.

Re: ExtCalendar

Posted: Tue Jul 11, 2006 1:53 am
by RobinH
If extcalendar is dying out, will anyone be creating a com for a new calendar interface???  Would really like to have one up and running.  So far I've been lucky and I think it's mainly because I'm on VPS, but others hosted by the same company on shared servers have been hacked via extcalendar, at least thats what they think was the point of entry.

Re: ExtCalendar

Posted: Tue Jul 11, 2006 2:12 am
by RobS
There is a com_events and another calender that I have heard will be released tomorrow so stay tuned to the Extensions page and check that out. 

Re: ExtCalendar

Posted: Tue Jul 11, 2006 2:22 am
by mom2nine
From what I've read, the exploit was posted online on Friday July 7th and the hack attacks began on Saturday the 8th.  The hackers didn't seem to replace the index.php, they modified configuration.php.  Seemed like two different hackers, however, one from Indonesia that posted a green "hacked" graphic with an "I'll be back" message, and one from Turkey (with some military type graphic and a musical background).  Fortunately, they didn't damage any data, the database is still intact, it seemed like the access was limited to the equivalent of drive-by graffiti.  But I spent about 24 hours over the weekend patching and upgrading and replacing stuff because of these creeps.

I saw a calendar component today called Thyme that appears to be ported for Joomla.  Anyone have experience with it?  I'm running news and information sites, we HAVE to have an events calendar.  Never dreamed something like this would happen, especially since I'd upgraded to 1.10 in Joomla.  Just goes to show, it can happen anytime, anywhere.

Anyone in favor of promoting some sort of severe penalty for hackers, like the amputation of a hand or something? 

Re: ExtCalendar

Posted: Tue Jul 11, 2006 2:33 am
by RobinH
I asked the question before doing the research and found at least three or four components/mods for calendar functions, however I'm going to wait and see how the upgrades go for these new issues.  I've still got extcalendar running fine for now.

Re: ExtCalendar

Posted: Tue Jul 11, 2006 4:57 am
by Chinaman
Yes I had a visit on one of my sites, however, could only see the alteration to the component file and an additional html file installed in site root. Checked config file, no changes there. Have uninstalled calendar as well as associated mods, will await to see new replacements.

Re: ExtCalendar

Posted: Tue Jul 11, 2006 6:23 am
by alamgir99
Hi
Consolation for me, I am not alone.
Right midnight my site was hacked in front of me! They changed the admin password, and then dont know what did.
I had to request a site restore to my hosting, (I dont have the privilegde.)

Who can I blame!

alamgir

Re: ExtCalendar

Posted: Tue Jul 11, 2006 9:22 am
by davidrrm
Has anyone tried Events Calendar? There's a fairly recent beta release.

david

Re: ExtCalendar

Posted: Tue Jul 11, 2006 11:00 am
by toemik
HI RobS
Would like to PM the IP etc but unable to

You are not allowed to send personal messages

Am I missing a trick here on how to PMS

Re: ExtCalendar

Posted: Tue Jul 11, 2006 11:47 am
by Floranett
Is there a new secure version of ExtCalender we can use?

Re: ExtCalendar

Posted: Tue Jul 11, 2006 12:20 pm
by n0fear2
// no direct access
defined( '_VALID_MOS' ) or die( 'Restricted access' );

insert this in extcal.php  as far as i read this fiexes the problem? RIGHT?

Re: ExtCalendar

Posted: Tue Jul 11, 2006 12:22 pm
by albi
Floranett wrote: Is there a new secure version of ExtCalender we can use?
http://extensions.joomla.org/component/ ... Itemid,35/

Re: ExtCalendar

Posted: Tue Jul 11, 2006 12:27 pm
by Floranett
albi wrote:
Floranett wrote: Is there a new secure version of ExtCalender we can use?
Mod. note: Fixed end quote tag -RobS

http://extensions.joomla.org/component/ ... Itemid,35/
Thanks alot albi m8, but can this be used with Mambo 4.5.3?  :)