6

Our Wordpress firewall Wordfence has flagged packages/Net/UserAgent/Detect/APC.php as possibly a malicious file. Based on past experience, I assume this is a false positive. However, I posted it here in case it is a real problem.

Filename: wp-content/civicrm 5.18.3/civicrm/packages/Net/UserAgent/Detect/APC.php

File Type: Not a core, theme, or plugin file from wordpress.org.

Details: This file appears to be installed or modified by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The matched text in this file is:

The issue type is: Suspicious:PHP/antibotInclude.C.7882

Description: Inclusion of an antibot file, often used in phishing kits

1

What I believe it's flagging based on the "description" line in your post is probably that the UserAgent tool could be used by bad people to get information about a browser, possibly to look for versions or configurations with known security holes to exploit. But it doesn't seem to be used in CiviCRM as far as I can see, and the APC.php subclass file all it does is store the results in the APC cache if you're using that. I wonder if the whole Net/UserAgent folder could be removed from Civi.

UPDATE: It looks like the file will be removed in civi version 5.22: https://github.com/civicrm/civicrm-packages/pull/272

| improve this answer | |
  • Same issue. Also looking for a definitive answer. I've posted a question on CiviCRM Chat / Town Square. Nothing definitive there yet. – dvhirst Dec 14 '19 at 18:54
  • I can definitely say it is not a virus. As noted in the answer all the file does is store the results of UserAgent Detect in the APC cache. But you're right as to why wordfence is flagging it, no I don't have a definitive answer to that. – Demerit Dec 14 '19 at 18:58
  • I believe I can safely tell WordFence to ignore the file. I'll do that, and keep an eye out here and on CiviCRM Chat. Thanks. – dvhirst Dec 14 '19 at 19:01
  • history for that code says it hasn't been touched in years, search for usage in packages shows no usage, and search for use in core indicates no use in core. 🔥🔥 burn it! – Chris Burgess Dec 16 '19 at 6:19
  • @chris-burgess Seamus has put up a PR to remove it. Can you comment there too? github.com/civicrm/civicrm-packages/pull/272 – Demerit Dec 16 '19 at 6:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.