Closed SpoiltNX closed 6 years ago
Shelob9
commented
6 years ago This is a really interesting find. Thank you.
Can you please try installing this as a plugin: https://gist.github.com/Shelob9/bd184ae701de55dcce2953107f914fa0
That should stop the submissions from invalid email addresses. If it stops the spams (make sure to test it does not stop legit submissions) than that's an easy fix we can put into 1.7.1.
SpoiltNX
commented
6 years ago @Shelob9 Thank you for your prompt response.
So upon further investigation we upgraded this issue from a SPAM issue to security issue. The emails were found to be a consequence of exploit probing not your classic form submission SPAM. Caldera Forms were a major target along with WooCommerce, but mostly Caldera Forms.
The best we can tell, some of these exploit probe requests would trigger some sort of error / change in behaviour and the form entries with all the fields filled in with a "1" seems to be a side effect.
Action Taken Since Last:
Questions:
Shelob9
commented
6 years ago @SpoiltNX Thanks for the additional information. Nothing we can do if the hack is inside of your server. In my opinion a security plugin is papering over a larger issue - your host isn't filtering malicious traffic.
Why do we need to add additional email validation? We were of the assumption that Caldera Forms was doing Email address validation. Is there no server side email address validation? I need to look, but I'm not sure there is server-side validation for it, if I'm right that's a bug.
Other than me adding that check, I can't really help besides recommending that you switch to a better host. I use WPEngine and Pantheon. I'd also trust Kinsta or Pagely.
SpoiltNX
commented
6 years ago @Shelob9 We have several integrated systems on that domain, so we actually host our own site. I think filtering malicious traffic is really nice but a website should not be vulnerable, insecure or changing behaviour without it.
Server side validation for me is very important, the data that makes it through to the database should be valid as per the type defined in the settings. I believe I should be able to trust the data that is stored in my own database, I should not have to run additional validation and sanitisation when trying to use data stored in our own database.
We have verified that we were not compromised, the security plugin uses normal rule based monitoring were if X number of failed login attempts, 404 requests or some metric in Y time is logged, your IP gets blocked (status code 403) for Z amount of time. So to my knowledge there is no papering over taking place, but rather reducing the impact and frequency of the issue.
If I understand you correctly there is not much you can do or take action on and would require more clear cut and reproducible information?
SpoiltNX
commented
6 years ago Additionally you should also take note that we since have received two more submissions that made it through not part of an attack with invalid email addresses.
EG:
Name: itwriytp
Email: upepouuo
Contact Number: oueuwyopClose via edb2b3e #2638
Caldera Forms Version : 1.6.1.1 & 1.7
PHP Version : 7.1
Description of Setup:
We use Caldera Forms in conjunction with WP Contact Slider. The form is available in a slider pop-out and on its own dedicated page.
Fields: Normal contact form style fields, name, email, where did you hear about us...
Processors: Auto Responder, Redirect
SPAM protection: Basic honey pot
Description of Problem
We have never had a spam problem, until today. We have been seeing a sudden influx of submissions where all fields are set to the value "1" including fields with validation on theme like Email.
EG:
Action taken:
We have identified the IP address through a hidden field and blocked it.
Apache Logs:
Below are some of the more interesting logs.
Please note it is company policy to remove any identifying information when publicly disclosing logs, so I have redacted with "xxx" some information.
PHP Logs
Below is the only PHP error logs that I can find that might be relevant to this. As there there only two entries and I have 70MB of access logs related to this one IP, so I am not sure the below is relevant and could possible be related to a plugin upgrade.
Expected Outcome
Submission entries should not have been created as they don't even pass basic validation. EG: email address.
Comments
Based on this we feel there is possibility of bug or issue related to Caldera Forms as the entries should not exist even if they are from a bot probing or trying different exploits.