How to remediate – Web Site Hosting Malicious Binaries

1. Introduction

The vulnerability “Web Site Hosting Malicious Binaries” means that harmful files are present on a web server. This could allow attackers to run code, steal data, or disrupt services. Web servers running any operating system and hosting public-facing websites are usually affected. A successful attack may compromise confidentiality, integrity, and availability of the website and potentially connected systems.

2. Technical Explanation

Malicious binaries indicate a server has been compromised and an attacker has uploaded harmful files. Exploitation typically involves an attacker gaining access to the web server through other vulnerabilities, then uploading and executing these binaries. The MD5 sum matching known malware is a strong indicator of compromise. Preconditions include successful initial access to the web server, often via weak credentials or unpatched software.

• Root cause: An attacker successfully uploaded malicious files to the web server.
• Exploit mechanism: An attacker uploads a malicious file (e.g., an .exe) and then executes it, potentially gaining control of the server. For example, they might exploit a file upload vulnerability in a website application.
• Scope: Any web server hosting files with extensions listed as being scanned (.exe , dll , scr , drv , sys , bat , cmd , com , cpl , csh , gadget , application , hta , inf , ins , inx , isu , job , jse , lnk , msc , msi , msp , mst , paf , pif , ps1 , ps1xml , ps2 , ps2xml , psc1 , psc2 , reg , rgs , sct , scf , shb , shs , u3p , vb , vbs , vbe , vbscript , ws , wsf , chm , jar , class , js , jse , swf , pdf , jsp , php , jpeg , jpg , asp , doc , docx , ppt , pptx , xls , xlsx).

3. Detection and Assessment

Confirming a system is vulnerable involves checking for the presence of malicious binaries. A quick check is to list files with the scanned extensions, looking for unusual names or sizes. Thorough assessment requires comparing MD5 hashes against known malware databases.

• Quick checks: List files with the specified extensions using the command line. For example, on Linux: find /var/www/html -type f ( -name "*.exe" -o -name "*.dll" -o -name "*.php" )
• Scanning: Nessus detected this vulnerability; review its findings for specific file names and MD5 hashes. Other antivirus or endpoint detection tools may also identify the binaries.
• Logs and evidence: Web server access logs should be reviewed for unusual file uploads or executions. Check system audit logs for suspicious activity related to these files.

find /var/www/html -type f ( -name "*.exe" -o -name "*.dll" -o -name "*.php" )

4. Solution / Remediation Steps

The primary solution is to delete the malicious files. This must be done carefully to avoid disrupting legitimate services.

4.1 Preparation

• Services: Stop the web server service (e.g., Apache, Nginx, IIS) to prevent further execution of malicious code.
• Dependencies: Ensure you have access to all relevant files and directories. Roll back plan: Restore from the backup if issues occur.
• Change window: Schedule a maintenance window with appropriate approval.

4.2 Implementation

1. Step 1: Identify the malicious file(s) reported by Nessus or other scanning tools.
2. Step 3: Delete the offending file(s) using the command line or file manager. For example, on Linux: rm /var/www/html/malicious_file.php
3. Step 4: Restart the web server service.

4.3 Config or Code Example

Before

ls -l /var/www/html/malicious_file.php

After

rm /var/www/html/malicious_file.php; ls -l /var/www/html/ 

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue.

• Practice 1: Least privilege – limit user accounts’ access to only the files and directories they need, reducing the impact if compromised.
• Practice 2: Input validation – validate all file uploads to ensure they are of an expected type and size, preventing malicious code from being uploaded.
• Practice 3: Patch cadence – Regularly update web server software and applications to address known vulnerabilities.

4.5 Automation (Optional)

If suitable, provide a small script or infrastructure code that applies the fix at scale. Only include if safe and directly relevant.

#!/bin/bash
# Script to remove malicious files based on MD5 hash
MD5_HASH="your_malicious_md5_hash" # Replace with actual hash
find /var/www/html -type f -print0 | xargs -0 md5sum | grep "$MD5_HASH" | awk '{print $2}' | while read file; do
  echo "Removing malicious file: $file"
  rm "$file"
done

5. Verification / Validation

Confirm the fix by verifying that the malicious files are gone and re-scanning for vulnerabilities.

• Post-fix check: Run ls -l /var/www/html/malicious_file.php; it should return “No such file or directory”.
• Re-test: Re-run the Nessus scan to confirm that the vulnerability is no longer detected.
• Smoke test: Access key website pages and functionality to ensure they are working as expected.
• Monitoring: Monitor web server logs for any further suspicious file uploads or executions. Example query: search for failed attempts to upload executable files.

ls -l /var/www/html/malicious_file.php

6. Preventive Measures and Monitoring

Several measures can help prevent this type of vulnerability.

• Baselines: Update security baselines to include file upload restrictions and regular malware scans.
• Asset and patch process: Implement a regular patch management cycle for web server software and applications.

7. Risks, Side Effects, and Roll Back

Deleting files can disrupt legitimate services if done incorrectly.

• Risk or side effect 2: Service disruption – stopping the web server service will cause downtime.
• Roll back: Restore from the backup created in step 4.1 if issues occur.

8. References and Resources

• Vendor advisory or bulletin: [If a specific vendor advisory exists, link it here]
• NVD or CVE entry: [If a CVE ID is associated with the malware, link it here]
• Product or platform documentation