@daemonitor/plugins 1.1.40 → 1.1.41
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -42,15 +42,16 @@ const BASE64_BLOB = /[A-Za-z0-9+/]{40,}={0,2}/;
|
|
|
42
42
|
const UPLOADS_PHP = /\/wp-content\/uploads\/.*\.php$/i;
|
|
43
43
|
const PLUGIN_PHP = /\/wp-content\/(?:plugins|mu-plugins)\/.*\.php$/i;
|
|
44
44
|
const BATCH_PATH = /^\/wp-json\/batch\/v1|rest_route=\/?batch\/v1/i;
|
|
45
|
+
// The omnisend-integration mu-plugin's wp_send_json_error "Security check
|
|
46
|
+
// failed" logs as 79 bytes direct from Cloudflare and 90 through cloudflared
|
|
47
|
+
// (since 2026-10-28); success logs as 77 and 88. Matching on size is the only
|
|
48
|
+
// signal the access log carries, so a change to that message, to nginx's gzip
|
|
49
|
+
// settings or to the proxy in front silences this rule.
|
|
50
|
+
const SUBSCRIBE_FAIL_BYTES = new Set([79, 90]);
|
|
51
|
+
const SUBSCRIBE_REFERER = /\/subscribe\/?(?:[?#]|$)/;
|
|
45
52
|
// wp-admin paths that answer 2xx to anonymous callers, so a 2xx on them proves
|
|
46
53
|
// nothing about being logged in. Everything else under /wp-admin/ redirects a
|
|
47
54
|
// logged-out visitor to the login form.
|
|
48
|
-
// The omnisend-integration mu-plugin's wp_send_json_error "Security check
|
|
49
|
-
// failed" gzips to exactly 79 bytes; success gzips to 77. Matching on size is
|
|
50
|
-
// the only signal the access log carries, so a change to that message or to
|
|
51
|
-
// nginx's gzip settings silences this rule.
|
|
52
|
-
const SUBSCRIBE_FAIL_BYTES = 79;
|
|
53
|
-
const SUBSCRIBE_REFERER = /\/subscribe\/?(?:[?#]|$)/;
|
|
54
55
|
const ANON_ADMIN = /^\/wp-admin\/(?:admin-ajax|admin-post|load-styles|load-scripts|install|setup-config)\.php$|^\/wp-admin\/(?:css|js|images|fonts)\//i;
|
|
55
56
|
// Read new bytes since last offset, advancing state. Handles rotation (file
|
|
56
57
|
// shrank → restart at 0) and partial trailing lines (buffered in remainder).
|
|
@@ -173,7 +174,7 @@ export function analyze(lines, cfg, windowSec, st) {
|
|
|
173
174
|
// every WP site is probed constantly for my.php / academy.php / etc., and
|
|
174
175
|
// those hits 404 (not there) or 403 (WAF-blocked). Alerting on the probes
|
|
175
176
|
// is pure noise; alert only when the shell actually RAN.
|
|
176
|
-
if (e.method === "POST" && pathNoQuery === "/wp-admin/admin-ajax.php" && e.bytes
|
|
177
|
+
if (e.method === "POST" && pathNoQuery === "/wp-admin/admin-ajax.php" && SUBSCRIBE_FAIL_BYTES.has(e.bytes) && SUBSCRIBE_REFERER.test(e.referer)) {
|
|
177
178
|
subscribeFail.set(e.ip, (subscribeFail.get(e.ip) || 0) + 1);
|
|
178
179
|
noteHost(e.ip, e.host);
|
|
179
180
|
}
|