@daemonitor/plugins 1.1.36 → 1.1.37

package/dist/plugins/monitoring/LogWatchPlugin.js

@@ -16,7 +16,7 @@ const MAX_READ = 5 * 1024 * 1024;
 //      $http_cf_connecting_ip is present it is logged AFTER $remote_addr (the CF
 //      edge), so "last IP" is the visitor, not the edge; when it's absent there
 //      is a single IP ($remote_addr) and "last" == "only".
-const REQ = /"([A-Z]+)\s+([^ "]+)[^"]*"\s+"?(\d{3})/;
+const REQ = /"([A-Z]+)\s+([^ "]+)[^"]*"\s+"?(\d{3})(?:"?\s+(\d+|-)\s+"([^"]*)")?/;
 const IP_TOKEN = /^(?:(?:\d{1,3}\.){3}\d{1,3}|(?:[0-9a-fA-F]{0,4}:){2,}[0-9a-fA-F]{0,4})$/;
 function parseLine(line) {
     const rq = REQ.exec(line);
@@ -34,7 +34,8 @@ function parseLine(line) {
     // origin address — there is no site name to report and "" is correct.
     const first = tokens[0] || "";
     const host = first !== "-" && !IP_TOKEN.test(first) ? first : "";
-    return { host, ip, method: rq[1], path: rq[2], status: Number(rq[3]), ua: "" };
+    const bytes = rq[4] && rq[4] !== "-" ? Number(rq[4]) : -1;
+    return { host, ip, method: rq[1], path: rq[2], status: Number(rq[3]), bytes, referer: rq[5] || "", ua: "" };
 }
 const SUSPICIOUS_QUERY = /(?:^|[?&])(c|k|cmd|exec|e|q|f|file|dir|download|0|1|a)=/i;
 const BASE64_BLOB = /[A-Za-z0-9+/]{40,}={0,2}/;
@@ -44,6 +45,12 @@ const BATCH_PATH = /^\/wp-json\/batch\/v1|rest_route=\/?batch\/v1/i;
 // wp-admin paths that answer 2xx to anonymous callers, so a 2xx on them proves
 // nothing about being logged in. Everything else under /wp-admin/ redirects a
 // logged-out visitor to the login form.
+// The omnisend-integration mu-plugin's wp_send_json_error "Security check
+// failed" gzips to exactly 79 bytes; success gzips to 77. Matching on size is
+// the only signal the access log carries, so a change to that message or to
+// nginx's gzip settings silences this rule.
+const SUBSCRIBE_FAIL_BYTES = 79;
+const SUBSCRIBE_REFERER = /\/subscribe\/?(?:[?#]|$)/;
 const ANON_ADMIN = /^\/wp-admin\/(?:admin-ajax|admin-post|load-styles|load-scripts|install|setup-config)\.php$|^\/wp-admin\/(?:css|js|images|fonts)\//i;
 // Read new bytes since last offset, advancing state. Handles rotation (file
 // shrank → restart at 0) and partial trailing lines (buffered in remainder).
@@ -115,6 +122,7 @@ export function analyze(lines, cfg, windowSec, st) {
     const adminOkIps = new Set(); // ip that then loaded an authed wp-admin page (2xx)
     const xmlrpcByIp = new Map(); // ip → POST xmlrpc count
     const webshell = new Map(); // pathNoQuery → sample
+    const subscribeFail = new Map(); // ip → "Security check failed" replies
     let total = 0;
     for (const line of lines) {
         const e = parseLine(line);
@@ -165,6 +173,10 @@ export function analyze(lines, cfg, windowSec, st) {
         // every WP site is probed constantly for my.php / academy.php / etc., and
         // those hits 404 (not there) or 403 (WAF-blocked). Alerting on the probes
         // is pure noise; alert only when the shell actually RAN.
+        if (e.method === "POST" && pathNoQuery === "/wp-admin/admin-ajax.php" && e.bytes === SUBSCRIBE_FAIL_BYTES && SUBSCRIBE_REFERER.test(e.referer)) {
+            subscribeFail.set(e.ip, (subscribeFail.get(e.ip) || 0) + 1);
+            noteHost(e.ip, e.host);
+        }
         const executed = e.status >= 200 && e.status < 300;
         const isUploadsPhp = UPLOADS_PHP.test(pathNoQuery);
         const isPluginShell = PLUGIN_PHP.test(pathNoQuery) && (SUSPICIOUS_QUERY.test(query) || BASE64_BLOB.test(query));
@@ -217,6 +229,14 @@ export function analyze(lines, cfg, windowSec, st) {
             });
         }
     }
+    for (const [ip, count] of subscribeFail) {
+        findings.push({
+            rule: "subscribe-nonce-fail", key: `subscribe-nonce:${ip}`, severity: "warning", ip,
+            path: "/wp-admin/admin-ajax.php",
+            title: "Subscribe form rejected a visitor",
+            detail: `${ip}: "Security check failed" on /subscribe/ (${count}×)${onSites(ip)}, a real signup was turned away`,
+        });
+    }
     const counts = {
         total,
         batchV1: [...batchIps.values()].reduce((a, b) => a + b, 0),
@@ -224,6 +244,7 @@ export function analyze(lines, cfg, windowSec, st) {
         batchBlocked,
         xmlrpcPosts: [...xmlrpcByIp.values()].reduce((a, b) => a + b, 0),
         webshellHits: [...webshell.values()].reduce((a, b) => a + b.count, 0),
+        subscribeFail: [...subscribeFail.values()].reduce((a, b) => a + b, 0),
         loginSuccess: st?.hideLogin ? 0 : [...loginOkIps].filter((ip) => adminOkIps.has(ip)).length,
         loginRedirectsAlways: !!st?.hideLogin,
     };
@@ -276,6 +297,6 @@ export function createLogWatchPlugin() {
         refreshTimer = null;
         states.clear();
     };
-    return createMonitoringPlugin("logwatch", "logwatch", "Access-log security watcher (WP2Shell / webshell / xmlrpc)", async () => { }, monitorFn, refreshFn, teardownFn);
+    return createMonitoringPlugin("logwatch", "logwatch", "Access-log security watcher (WP2Shell / webshell / xmlrpc / subscribe form)", async () => { }, monitorFn, refreshFn, teardownFn);
 }
 export default createLogWatchPlugin;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daemonitor/plugins",
-  "version": "1.1.36",
+  "version": "1.1.37",
   "description": "daemonitor plugins",
   "types": "types/index.d.ts",
   "main": "dist/index.js",