Skip to main content
M
marco99
Inspiring
February 13, 2013
Answered

Hacked Response Header to Googlebot

  • February 13, 2013
  • 1 reply
  • 2085 views

We have a website that, when browsed by Googlebot (or any test site that uses the Googlebot 2.1 http_user_agent ID) embedds a bunch of links in the response header (spam link for Cialis). What anyone else sees in the their browser is the regular website as the spam links are not inserted into the response header. The web server is IIS on Windows Server 2008 (with the latest patches) and CF is CF 9 Enterprise. I initially thought that it was an attack on IIS that corrupted the system, but there are several other websites on the same server that aren't affected. If something affected a core dll file or something like that, it seems like it would affect all sites. In looking at all of our .cfm files and files that they reference (e.g. .js) they are fine - the malicous content isn't in any of them. However, something has become corrupted that enables this content to be put in the http response header. I've heard of similar attacks ("Pharma hacks") on Wordpress and Joonla, but nothing in reference to ColdFusion.Does anyone have any ideas?

    This topic has been closed for replies.
    Correct answer WolfShade

    Look for files that don't belong (typically named i.cfm or h.cfm, but it could be anything), remove them and apply the latest security patch.

    ^_^

    1 reply

    WolfShade
    WolfShadeCorrect answer
    Legend
    February 13, 2013

    Look for files that don't belong (typically named i.cfm or h.cfm, but it could be anything), remove them and apply the latest security patch.

    ^_^

    M
    marco99Author
    Inspiring
    February 13, 2013

    Yeah, I found an h.cfm file that clearly doesn't belong in the root of the CFIDE folder for every site on the server. It appears to be a file manager that likely gave them access to the whole serer file system. I see that this appears to be some type of exploit of the admin api system for CF and Adobe now has a patch for it. I'm hoping I can find what other files they altered so I don't have to compeltely uninstall CF, shutting down all of the websites, and then re-installing everything.

    WolfShade
    WolfShade
    Legend
    February 13, 2013

    As I understand it, I think just removing the files that don't belong and applying the patch should be sufficient.  But browse this forum for the same situation - there are instructions, somewhere, that I don't have the URL for.

    ^_^

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices