I am using hook_cron to send an emails from my site. Within the email there is a link *created with $base_root*

<p>Your TEST has finished Processing. Visit ".$base_root."/?q=test/".$id. " to view it </p>

A couple of days ago I received an email and the $base_root variable was converted to:

Your TEST has finished Processing. Visit <strong>http://www.sina.com.cn</strong>/?q=test/68

This url is not at all the url for my site.

The only thing I dould find in the logs was a couple of page not found errors:
page not found 08/24/2015 - 15:55 ttp://www.sina.com.cn Anonymous (not verified)

and I noticed that for that CRON run the logs reported that it run on that server.

I would expect the logs to look like:
crongood

but this is what I saw in the logs.
cronbad.JPG

Since then I have checked any other ways in which the site could have been hacked, but could not find any...

Any idea?

CommentFileSizeAuthor
#14 logsina002.JPG37.94 KBgamaliz
#14 logsina001.JPG43.43 KBgamaliz
#9 cronsettings.JPG57.56 KBgamaliz
cronbad.JPG35.45 KBgamaliz
crongood.JPG40.83 KBgamaliz
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

gamaliz@gmail.com created an issue. See original summary.

gamaliz’s picture

gamaliz CreditAttribution: gamaliz commented
Issue summary: View changes
dawehner’s picture

dawehner
Primary language German
CreditAttribution: dawehner as a volunteer and at Tag1 Consulting commented

I'm curious, what does \Drupal::state()->get('system.cron_key'); return for you?

gamaliz’s picture

gamaliz CreditAttribution: gamaliz commented

do you have the exact php code?

Fatal error: Class 'Drupal' not found in /srv/www/htdocs/sites/all/modules/custom/...

gamaliz’s picture

gamaliz CreditAttribution: gamaliz commented

I am running Drupal 7.39...

gamaliz’s picture

gamaliz CreditAttribution: gamaliz commented

if I try the code to get my current cron.key I do get it back.

define('DRUPAL_ROOT', getcwd());

include_once DRUPAL_ROOT . '/includes/bootstrap.inc';
drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL);

dpm(variable_get('cron_key', 'drupal'));
}

I also (since the issue) updated my key to a different one.

cilefen’s picture

cilefen CreditAttribution: cilefen commented
Component: configuration entity system » cron system
Issue tags: -cron, -http://www.sina.com.cn/, -email

I removed some tags that won't help anyone find this issue.

cilefen’s picture

cilefen CreditAttribution: cilefen commented

What are your cron settings in the UI?

gamaliz’s picture

gamaliz CreditAttribution: gamaliz commented
FileSize
cronsettings.JPG57.56 KB

cronsettings.JPG

cilefen’s picture

cilefen CreditAttribution: cilefen commented

Cron will run any time somebody browses the site if it has not run for an hour with that configuration. What you saw in the log could be some variation of that, plus something odd of course.

If you are explicitly running cron by doing a get to the special cron URL regularly, you can set that to "Never".

gamaliz’s picture

gamaliz CreditAttribution: gamaliz commented

No, I understand that if the site does not run, cron will not run (I mean the drupal cron, as the service on the linux server will). I never run cron using the url unless I am testing something.

Now, What I do not understand is why on that cron run, it was picked up as the location of that other server. This is (I assume) what caused my code inside the hook_cron() to initialize the variable as the site in china ($base_root). This should not happen, even if I run cron using the url. And, even if they have my cron key (which I don't think is what happened), all they could do is run CRON until DOS... But how did they get to run cron as if it run on another server I have no idea...

cilefen’s picture

cilefen CreditAttribution: cilefen commented
Issue tags: +Security
cilefen’s picture

cilefen CreditAttribution: cilefen commented

This is a security issue if somebody can inject a URL into the logs.

gamaliz’s picture

gamaliz CreditAttribution: gamaliz commented
FileSize
logsina001.JPG43.43 KB
logsina002.JPG37.94 KB

Not into the logs.

here is some of the code from my hook_cron: 

global $base_root;
 $query = new EntityFieldQuery();
  $query
    ->entityCondition('entity_type', 'test', '=')
    ->propertyCondition('status', '0', '=');
  $result = $query->execute();
 if(!isset($result['test'])) return;

 foreach($result['test'] as $record) {
....
 if($ent[$id]->email_notify == 1 ) {
      $user = user_load($ent[$id]->uid);
      custom_mod_dataupload_drupal_mail($from = 'myemail@dd.com',$user->mail , 'Your TEST has finished processing',
      "<html><head></head><body>Hi ".$user->name ."<br/> <p>Your TEST has finished Processing. Visit ".$base_root."/?q=mri/".$id. " to view it </p> <br/>Thanks</body></html>");

     }
}

I have a custom entity which I query, and based on certain conditions I send an email to certain users.
They were able to insert a url at that level. The expected value of $base_root is the url of the server where the code is located. They were able to fake that....

I have checked my site since then, Downloaded the hacked module, ran drush drupalgeddon, checked the database, but could not find anything on my code which will cause that behaviour. I also have this on the logs from about the same timelogsina002.JPG:
logsina001.JPG

cilefen’s picture

cilefen CreditAttribution: cilefen commented

HTTP_HOST header is spoofable.

https://api.drupal.org/api/drupal/includes%21bootstrap.inc/function/drup...

Drupal 8 has added protection against that. https://api.drupal.org/api/drupal/sites!default!default.settings.php/8

cilefen’s picture

cilefen CreditAttribution: cilefen commented

See "Trusted host configuration" in default.settings.php.

cilefen’s picture

cilefen CreditAttribution: cilefen commented

Protecting against HTTP host header attacks.

gamaliz’s picture

gamaliz CreditAttribution: gamaliz commented

I am running drupal 7.39 (not 8) The links you sent seem to apply to Drupal 8. I have no "Trusted host configuration" in default.settings.php. What can I do to protect my drupal 7 installation?

I do believe this is exactly what is happening.

gamaliz’s picture

gamaliz CreditAttribution: gamaliz commented

Is this an issue with apache or drupal? or a confuguration problem?

cilefen’s picture

cilefen CreditAttribution: cilefen commented

#17 explains what to do on Drupal 7 and 8.

cilefen’s picture

cilefen CreditAttribution: cilefen commented
Category: Bug report » Support request

For example:

You can set a specific domain as your $base_url in sites/default/settings.php. While the dynamic detection can be a handy feature it can also cause problems. One way to stop that is just to set a permanent value.

gamaliz’s picture

gamaliz CreditAttribution: gamaliz commented

Thanks, I will keep an eye after I make these changes to see if they don't happen again.

cilefen’s picture

cilefen CreditAttribution: cilefen commented

You can probably simulate it with curl if you want to do a before-and-after test.

gamaliz’s picture

gamaliz CreditAttribution: gamaliz commented

Thanks, that was really helpful.

cilefen’s picture

cilefen CreditAttribution: cilefen commented

@gamaliz Great. If you figured out a test script, definitely share it.

apaderno’s picture

apaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
CreditAttribution: apaderno commented
Issue tags: -$base_root
cilefen’s picture

cilefen CreditAttribution: cilefen commented
Status: Active » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.