Suppress checksum-verified files from the suspicious-filename check - #227
Merged
Conversation
Checksum verification (5.22.0) only skipped the content pattern-match scan. The separate suspicious-filename check in scanner-general.php, which runs during file discovery, still flagged unmodified core files whose names happen to match a known-malware substring - wp-includes/SimplePie/src/Cache/MySQL.php and wp-includes/Text/Diff/Engine/shell.php match "mysql.php"/"shell.php" - even after those exact files passed checksum verification. A file already confirmed checksum-clean is now skipped by the filename check too, for the same reason the pattern-match scan skips it: an unmodified core/plugin file can't be the payload regardless of what its filename looks like. Non-verified files (uploads, themes, custom plugins) are scanned exactly as before, so a real dropped webshell named c99.php or shell.php is still caught. scanner-targeted.php has no filename check and needs no change. Verified against a real WordPress install (aseonomics.com production) where these two files were previously flagged, and with a local test injecting a verified-file entry alongside an actual malicious upload to confirm the real threat is still caught while only the verified file is suppressed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Checksum verification (v5.22.0) only ever skipped the content pattern-match scan.
scanner-general.phphas a separate suspicious-filename check that runs during file discovery, and it kept flagging unmodified core files whose names happen to match a known-malware substring — confirmed live against aseonomics.com production:wp-includes/SimplePie/src/Cache/MySQL.phpandwp-includes/SimplePie/library/SimplePie/Cache/MySQL.phpmatchingmysql.phpwp-includes/Text/Diff/Engine/shell.phpmatchingshell.phpBoth are stock, unmodified WordPress core files that already passed checksum verification, so this was still a documented false positive the checksum feature didn't actually eliminate.
Fix
A file already confirmed checksum-clean is now skipped by the filename check too — same reasoning as the pattern-match skip: an unmodified core/plugin file can't be the payload regardless of what its filename looks like. Non-verified files (uploads, themes, custom plugins) are scanned exactly as before, so a real dropped webshell named
c99.phporshell.phpthere is still caught.scanner-targeted.phphas no filename check and needs no change.Testing
SimplePie/Cache/MySQL.phpalongside an actual maliciousc99.phpupload. Confirmed the verified file no longer appears under suspicious filenames (and is counted in a new "suppressed" stat), whilec99.phpis still caught as both a suspicious filename and a CRITICAL pattern match.Follow-up to #225 / #226.