High risk bug report | Wordpress Extension copying unknown database credentials

[grumbi84]

TITLE:

High risk bug report | Wordpress Extension copying unknown database credentials​

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE:

Onyx 17.8 | Debian 8.11​

PROBLEM DESCRIPTION:

Hello,

as it wasn't possible to submit a support ticket, as I have a license from a plesk reseller, I publish it here:

On my server I have experienced 2x a critical issue.

When cloning Wordpress data (using Wordpress management extension) from an instance to a newly created one, this happens:

- one (was always different) out of about 15 Wordpress instances gets a new wp-config.php placed where the old one was and replaces it
- the one chosen instance was neither source, nor destination of cloning
- it contains genuine (working!) wordpress database credentials from an unknown wordpress installation from a different country?!

---

Question:
Additionally to this high risk bug, I would like to know, where the Wordpress extension is syncing my config files to?! It should never leave my server.

My server is based in Germany and the wp-config-file which was placed, belongs to an IP-address in Canada. I doubt a Canadian is using a German server for his website. So I suppose Plesk is syncing it somewhere.

Best regards​

STEPS TO REPRODUCE:

- Create a new subscription
- Go to Wordpress management extension
- Clone an old subscription to the newly created one
- Ovewrite files, if needed
- Run cloning

Not sure, if it happens always.​

ACTUAL RESULT:

Independent Wordpress instance on my server gets a new wp-config.php file from an unknown, but genuine, source.

Old file get's overwritten.​

EXPECTED RESULT:

This should not happen.​

ANY ADDITIONAL INFORMATION:

​

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM:

Answer the question​

 

[zanuda]

Thank you for your report!
It is very strange behaviour. I can not imagine how it can be performed.
But of course we will try to reproduce this issue. I'm going to investigate this issue and let you know a results or request some an additional information. I hope to get back to you on Monday/Tuesday with first results.

 

[grumbi84]

Do you have an update?

 

[IgorG]

Here is reply from our developer:

WordPress toolkit is working within one server. It can't clone WordPress'es between different servers.
We are copying a wp-config.php from source WordPress to the Destination instance only (which always empty before cloning).
We aren't not syncing wp-config by default while "sync" of WordPress instances.
I tried to reproduce your situation in different configurations of installed wordpress (including case when a few WordPress instances at source subscription), a some additional domains and subdomains with WordPress'es at destination subscription, but i couldn't do it.
Please ask your admin or reseller to contact with our Support team

 

[grumbi84]

Thanks Igor, I will get in touch with my reseller.

 

[Bitpalast]

To me this rather sounds like a malware that is modifying files in the Wordpress installations. I haven't seen the issue that is described in this thread occur in any of thousands of Wordpress installations of our customers.