A major company called us early last week and told us that they were alerted that they have the Sweet Orange Exploit Kit on their Joomla website. They said that a tool that they’re using to block malware sites, called ProofPoint, has blocked their own website because it contains malware!
The report generated by ProofPoint claimed that the file, http://[www.ourclientjoomlawebsite.com]/modules/mod_ariextmenu/mod_ariextmenu/js/menu.min.js, was hacked. That file, for those who don’t know, is used to support the ARI Ext Menu module. We checked the file and true enough, it was hacked. We restored a clean version of the file from the backup, but it didn’t take long for that file to get hacked again. Hmmm….
This meant one of two things: 1) Either there are some malicious PHP files on the server (that were uploaded earlier) and that are used to hack the aforementioned JavaScript file, or 2) the ARI Ext Menu module is a vulnerable extension which is exploitable by malicious users.
It didn’t take us long to discover that it was the latter scenario: A file called menu.min.php was created under the /modules/mod_ariextmenu/js folder (the same folder that contained the hacked file). This file, which seemed benign at first glance (because it had the same last modify date as the other files in the same directory and because its name seemed legitimate) was not: it contained some base64_decode code which was creating a backdoor to the hackers to literally do anything on the website. Naturally, we deleted the file, but, as expected, it re-emerged within 15 minutes, and then it infected the same JavaScript file, again!
Eventually, we created an .htaccess file that disabled the direct execution of PHP files under the whole modules folder. Here is the code that we added to that .htaccess file:
<Files *.php> deny from all </Files>
That gave us some room to replace the ARI Ext Menu module with another module to generate the menu (we ended up overriding the template of the native Joomla menu module). Once we did that, we immediately uninstalled the ARI Ext Menu module and we told our satisfied client to stick with native Joomla extensions when possible.
We monitored the site for a full day after uninstalling the module (we checked the logs constantly) and we are glad to say that the hack hasn’t returned.
A couple of days after fixing the problem, we had another Joomla website hacked with the Sweet Orange Exploit Kit, but this time it was the mootools-core.js file located under the media/system/js folder. That website was running a very old version of Joomla 2.5 (it was 2.5.11) so updating it to the latest version did the trick (of course, we replaced the mootools-core.js file with a clean version prior to updating the website).
If your Joomla website was hacked with the Sweet Orange Exploit Kit (we know, there’s nothing sweet about this hack) then fear not, it is (probably) not the end of the world. There is a way to clean the website despite the fact that this type of hack is extremely persistent. All you need to do is to contact us and we will see that your website becomes clean again in as little time as possible and for a very little fee. We will also ensure that your website remains clean for the foreseeable future!