6

Our Wordpress firewall Wordfence has flagged packages/Net/UserAgent/Detect/APC.php as possibly a malicious file. Based on past experience, I assume this is a false positive. However, I posted it here in case it is a real problem.

Filename: wp-content/civicrm 5.18.3/civicrm/packages/Net/UserAgent/Detect/APC.php

File Type: Not a core, theme, or plugin file from wordpress.org.

Details: This file appears to be installed or modified by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The matched text in this file is:

The issue type is: Suspicious:PHP/antibotInclude.C.7882

Description: Inclusion of an antibot file, often used in phishing kits

Improve this question

1 Answer 1

Reset to default
1

What I believe it's flagging based on the "description" line in your post is probably that the UserAgent tool could be used by bad people to get information about a browser, possibly to look for versions or configurations with known security holes to exploit. But it doesn't seem to be used in CiviCRM as far as I can see, and the APC.php subclass file all it does is store the results in the APC cache if you're using that. I wonder if the whole Net/UserAgent folder could be removed from Civi.

UPDATE: It looks like the file will be removed in civi version 5.22: https://github.com/civicrm/civicrm-packages/pull/272

Improve this answer
7
  • Same issue. Also looking for a definitive answer. I've posted a question on CiviCRM Chat / Town Square. Nothing definitive there yet.
    – dvhirst
    Dec 14, 2019 at 18:54
  • I can definitely say it is not a virus. As noted in the answer all the file does is store the results of UserAgent Detect in the APC cache. But you're right as to why wordfence is flagging it, no I don't have a definitive answer to that.
    – Demerit
    Dec 14, 2019 at 18:58
  • I believe I can safely tell WordFence to ignore the file. I'll do that, and keep an eye out here and on CiviCRM Chat. Thanks.
    – dvhirst
    Dec 14, 2019 at 19:01
  • history for that code says it hasn't been touched in years, search for usage in packages shows no usage, and search for use in core indicates no use in core. 🔥🔥 burn it!
    – Chris Burgess
    Dec 16, 2019 at 6:19
  • @chris-burgess Seamus has put up a PR to remove it. Can you comment there too? github.com/civicrm/civicrm-packages/pull/272
    – Demerit
    Dec 16, 2019 at 6:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.