search

nextcloud / files_antivirus

👾 Antivirus app for Nextcloud Files
https://apps.nextcloud.com/apps/files_antivirus
GNU Affero General Public License v3.0
81 stars 33 forks source link

Test with virus test file generates multiple detection errors in unrelated files #345

Closed caguiar closed 2 weeks ago

caguiar commented 2 weeks ago

Steps to reproduce

  1. Put eicar.com in nextcloud user directory (using Nextcloud client).

Expected behaviour

The background scan job should detect the "infected file" such as: [files_antivirus] Erro: Infected file found (during background scan) Win.Test.EICAR_HDB-1 File: 74374896 Account: 97C5B7E0-4380-41D7-B203-5EC3195AD4CC Path: /97C5B7E0-4380-41D7-B203-5EC3195AD4CC/files/Virus test files/eicar.com

Actual behaviour

The background scan job reports hundreds of files with the same "virus signature" such as: [files_antivirus] Erro: Infected file found (during background scan) Win.Test.EICAR_HDB-1 File: 73456834 Account: 97C5B7E0-4380-41D7-B203-5EC3195AD4CC Path: /97C5B7E0-4380-41D7-B203-5EC3195AD4CC/files/ASSINATURAS/Declaracao_de_inexistencia_de_conflito_de_interesses_38243_693316_funcoes_procedimento.doc.docx

Server configuration

Operating system: uBuntu 22.04

Web server: Apache2 2.4.52

Database: mysql-server-8.0 8.0.37

PHP version: php8.1 8.1.12

Nextcloud version: (see Nextcloud admin page) 29.0.2

Where did you install Nextcloud from:

List of activated apps: Enabled:

Nextcloud configuration: { "system": { "instanceid": "REMOVED SENSITIVE VALUE", "passwordsalt": "REMOVED SENSITIVE VALUE", "datadirectory": "REMOVED SENSITIVE VALUE", "dbtype": "mysql", "version": "29.0.2.2", "dbname": "REMOVED SENSITIVE VALUE", "dbhost": "REMOVED SENSITIVE VALUE", "dbtableprefix": "oc_", "dbuser": "REMOVED SENSITIVE VALUE", "dbpassword": "REMOVED SENSITIVE VALUE", "installed": true, "loglevel": 2, "log_rotate_size": 104857600, "ldapIgnoreNamingRules": false, "theme": "", "maintenance": false, "maintenance_window_start": 1, "trusted_domains": [ "nextcloud.arditi.pt", "cloud.arditi.pt", "owncloud.arditi.pt" ], "mail_domain": "REMOVED SENSITIVE VALUE", "mail_smtpmode": "smtp", "mail_from_address": "REMOVED SENSITIVE VALUE", "secret": "REMOVED SENSITIVE VALUE", "allow_local_remote_servers": true, "trashbin_retention_obligation": "auto,60", "versions_retention_obligation": "auto", "memcache.local": "\OC\Memcache\APCu", "memcache.locking": "\OC\Memcache\Redis", "redis": { "host": "REMOVED SENSITIVE VALUE", "port": 6379 }, "updatechecker": false, "singleuser": false, "ldapProviderFactory": "\OCA\User_LDAP\LDAPProviderFactory", "overwrite.cli.url": "https:\/\/cloud.arditi.pt", "mail_smtphost": "REMOVED SENSITIVE VALUE", "default_phone_region": "PT", "twofactor_enforced": "false", "twofactor_enforced_groups": [], "twofactor_enforced_excluded_groups": [], "mysql.utf8mb4": true, "app_install_overwrite": [ "extract", "sharelisting", "groupfolders", "issuetemplate" ] } }

Client configuration

Browser: Firefox

Operating system: Mac OS

Logs

Nextcloud log (data/owncloud.log)

{"reqId":"KH6QOcqN74SyheyP10XO","level":3,"time":"2024-06-17T12:25:04+00:00","remoteAddr":"","user":"--","app":"files_antivirus","method":"","url":"--","message":"Infected file found (during background scan) Win.Test.EICAR_HDB-1 File: 74374896 Account: 97C5B7E0-4380-41D7-B203-5EC3195AD4CC Path: /97C5B7E0-4380-41D7-B203-5EC3195AD4CC/files/Virus test files/eicar.com","userAgent":"--","version":"29.0.2.2","data":{"app":"files_antivirus"}} {"reqId":"KH6QOcqN74SyheyP10XO","level":3,"time":"2024-06-17T12:25:05+00:00","remoteAddr":"","user":"--","app":"files_antivirus","method":"","url":"--","message":"Infected file found (during background scan) Win.Test.EICAR_HDB-1 File: 372553 Account: D2EC5F2B-8633-4735-A829-1E878CD910BC Path: /D2EC5F2B-8633-4735-A829-1E878CD910BC/files/ARDITI_2016/CIVITAS-DESTINATIONS (local)/backups-manter/CIVITUR PROPOSAL_H2020TOPIC MG5.5.-2015 - Backup/2nd Stage/calcular_monthly_rate_ARDITI_22092015.xlsx","userAgent":"--","version":"29.0.2.2","data":{"app":"files_antivirus"}} {"reqId":"KH6QOcqN74SyheyP10XO","level":3,"time":"2024-06-17T12:25:05+00:00","remoteAddr":"","user":"--","app":"files_antivirus","method":"","url":"--","message":"Infected file found (during background scan) Win.Test.EICAR_HDB-1 File: 67234714 Account: 82FC82A3-391D-4D9F-8626-93C8185C0A5E Path: /82FC82A3-391D-4D9F-8626-93C8185C0A5E/files/Documents/Vanessa/CON P\u00daB DOS SERVI\u00c7OS E ESCOLAS/Machico/comunica\u00e7\u00f5es/comunica\u00e7\u00e3o 25 10 17.docx","userAgent":"--","version":"29.0.2.2","data":{"app":"files_antivirus"}} {"reqId":"KH6QOcqN74SyheyP10XO","level":3,"time":"2024-06-17T12:25:05+00:00","remoteAddr":"","user":"--","app":"files_antivirus","method":"","url":"--","message":"Infected file found (during background scan) Win.Test.EICAR_HDB-1 File: 372998 Account: D2EC5F2B-8633-4735-A829-1E878CD910BC Path: /D2EC5F2B-8633-4735-A829-1E878CD910BC/files/ARDITI_2016/CIVITAS-DESTINATIONS (local)/backups-manter/CIVITUR PROPOSAL_H2020TOPIC MG5.5.-2015 - Backup/docs_v\u00e1rios/Sintra. Portugal Mobility Services for Tourists Eltis_files/css9fsv4JS-crzuaScPV-8Ga5FZdJ7rEfX0A-U-NpYbXs.css","userAgent":"--","version":"29.0.2.2","data":{"app":"files_antivirus"}}

And the list goes on and on.

Insert your Nextcloud log here


#### Browser log

Insert your browser log here, this could for example include:

a) The javascript console log b) The network log c) ...

kesselb commented 2 weeks ago

Caused by https://github.com/nextcloud/files_antivirus/commit/a864119a150b6035c049b0ef6711c9458b0a8c09#diff-fef93b10df7e905ff9951ccdf7793f9072e6a5afca34bb1ce050d63d1e32ece1R49

caguiar commented 2 weeks ago

I would say that this is a dangerous issue since if the configuration is set for "Delete files", it deletes an unknown number of files. This did happen to me, fortunately, I do have backups. Hope the new version with the fix is released soon.