How to remediate – Piwik core/Loader.php Trojaned Distribution

1. Introduction

Piwik core/Loader.php contains a backdoor that allows remote attackers to execute arbitrary PHP code with the privileges of the web server user. This poses a high risk to confidentiality, integrity and availability as an attacker could potentially take full control of the web server and any associated data. Systems running vulnerable versions of Piwik are affected.

2. Technical Explanation

The vulnerability exists due to backdoored code added to the ‘core/Loader.php’ script within a compromised version of Piwik. This allows an attacker to launch shell commands via ‘core/DataTable/Filter/Megre.php’, and receive notifications through a web form hosted on prostoivse.com. The malicious code was inserted into copies of ‘latest.zip’ downloaded between 15:43 UTC and 23:59 UTC on 11/26/2012.

• Root cause: Compromised Piwik distribution package containing a trojaned ‘core/Loader.php’ file.
• Exploit mechanism: An attacker downloads the compromised Piwik installation, deploys it to a web server, and then uses the backdoored code to execute arbitrary PHP commands. For example, an attacker could use the backdoor to create a new administrator account or modify website content.
• Scope: Piwik installations updated from ‘latest.zip’ between 15:43 UTC and 23:59 UTC on 11/26/2012 are affected.

3. Detection and Assessment

Confirming a system is vulnerable involves checking the integrity of core Piwik files and reviewing logs for suspicious activity.

• Quick checks: Verify the Piwik version installed. This does not confirm compromise but helps narrow scope.
• Scanning: Nessus vulnerability ID e9c4045a can detect this issue, though it only verifies code execution through the backdoor.
• Logs and evidence: Examine web server access logs for requests to ‘core/DataTable/Filter/Megre.php’ or connections to prostoivse.com. Check Piwik database tables for unexpected data changes.

grep -r "prostoivse.com" /path/to/piwik/installation

4. Solution / Remediation Steps

The following steps outline how to remediate the Piwik core/Loader.php Trojaned Distribution vulnerability.

4.1 Preparation

• Ensure you have access to a clean copy of the Piwik source code from the official project repository. A roll back plan is to restore the pre-compromised backup.
• A change window may be needed depending on your environment and impact tolerance. Approval from security team may be required.

4.2 Implementation

1. Step 1: Download a clean copy of Piwik source code from the official repository.
2. Step 2: Replace the compromised ‘core/Loader.php’ file with the clean version.
3. Step 3: Review all other core files for any unexpected modifications.
4. Step 4: Clear the Piwik cache to ensure changes take effect.
5. Step 5: Restart the web server service.

4.3 Config or Code Example

Before

After

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this type of vulnerability.

• Practice 1: Least privilege – Run the web server process with minimal necessary permissions to limit damage if exploited.
• Practice 2: Input validation – Implement strict input validation on all user-supplied data to prevent code injection attacks.
• Practice 3: Patch cadence – Regularly update Piwik and other software components to address known vulnerabilities.

4.5 Automation (Optional)

Automation is not recommended for this specific vulnerability due to the risk of deploying incorrect files. Manual verification is essential.

5. Verification / Validation

Confirming the fix involves verifying file integrity and testing functionality.

• Post-fix check: Verify that ‘core/Loader.php’ matches the checksum from a known clean source.
• Re-test: Re-run Nessus scan (e9c4045a) to confirm the vulnerability is no longer detected.
• Smoke test: Access key Piwik features, such as reporting and user management, to ensure functionality remains intact.
• Monitoring: Monitor web server logs for any suspicious activity related to ‘core/DataTable/Filter/Megre.php’.

md5sum /path/to/piwik/installation/core/Loader.php # Compare output with known good checksum

6. Preventive Measures and Monitoring

Implementing preventive measures can reduce the risk of future compromises.

• Baselines: Update security baselines to include file integrity monitoring for critical Piwik files.
• Pipelines: Integrate static code analysis (SAST) into CI/CD pipelines to detect potential vulnerabilities in custom Piwik plugins or themes.
• Asset and patch process: Establish a regular patch review cycle for all web applications, including Piwik.

7. Risks, Side Effects, and Roll Back

Replacing core files carries some risk.

• Risk or side effect 1: Incorrect file replacement could break functionality. Mitigation is to restore from backup immediately.
• Risk or side effect 2: Downtime may be required during the replacement process. Mitigation is to schedule maintenance window.
• Roll back: Restore the pre-compromised Piwik installation directory and database from your backup. Restart the web server service.

8. References and Resources

• Vendor advisory or bulletin: https://forum.matomo.org/t/alert-security-issue-latest-zip-is-infected/8416
• NVD or CVE entry: http://www.nessus.org/u?e9c4045a
• Product or platform documentation relevant to the fix: N/A