By awebmanager on

I have several Drupal 6 and 7 sites hosted on the same server. Yesterday I got this "New release(s) available" email for one of my sites. The domain in the link to the available updates page is definitely not the domain of my site. Has my site been hacked?? I've checked in a few admin pages etc and nothing else seems to have changed.

I did click the link incidentally when I first saw it and just got a 404 page but I guess it's probably not a good idea to click the links.

There is a security update available for your version of Drupal. To ensure the security of your server, you should update immediately!

There are security updates available for one or more of your modules or themes. To ensure the security of your server, you should update immediately!

See the available updates page for more information:
http://testp1.piwo.pila.pl/admin/reports/updates

Your site is currently configured to send these emails when any updates are available. To get notified only for security updates, http://testp1.piwo.pila.pl/admin/reports/updates/settings.

⋅ Categories: Drupal 6.x, Drupal 7.x

Comments

awebmanager’s picture

awebmanager commented

I've since searched my database for that domain and it returns 9 entries in watchdog including "cron run completed" from location http://testp1.piwo.pila.pl/http://testp1.piwo.pila.pl/testproxy.php

nevets’s picture

nevets commented

Where did the email come from (whats the from email address)?

awebmanager’s picture

awebmanager commented

It came from the site's email address (the one set in /admin/config/system/site-information)

bhammond@coloradovirtuallibrary.org’s picture

bhammond@coloradovirtuallibrary.org commented

This just happened to one of my sites, too. Any resolution to this, OP?

gisle’s picture

gisle
he/him
Primary language Norwegian Bokmål
Location Norway
commented

I am a hosting provider, and I've recently had several clients that experience this on their Drupal 7 sites.

In all incidents, in addition to having the "update available" sent from a "foreign" domain (as described in the issue summary), the "foreign" domain also appears in the site's watchdog table (Reports » Recent log messages in the Admin GUI), reporting on runs of poormanscron. Example:

Type cron
Date Monday, October 17, 2016 - 16:05
User Anonymous (not verified)
Location http://www.redacted.com
Referrer  
Message Cron run completed.
Severity notice
Hostname 129.redacted
Operations  

There is no other trace of the "foreign" domain in the database, and forensics reveal no other anomaly with the site's files or database (i.e. the site does not appear to have been hacked).

The common denominators for this to happen seem to be:

  • Site configured for dynamic detection of the $base_url.
  • Email notification is sent by poormanscron.

Armed with this information, I googled the problem and arrived at this page at the Acquia site: Controlling your site's domain usage across environments.

From what I gather, the cure is to set $base_url explicitly in settings.php.

- gisle