WEDOS & Changing MENU option triggers Human Challenge Prompt every time (and breaks Menu)

[MonyMony]

Hello fellow users,

I made a small change to my menu options this morning to add a new option. I think I might have made a small typo to the icon but after saving I keep getting a WEDOS prompt on my site instead of the menu. (I have since reverted the change from a recent backup file)

IMG_0278.png (752.19 KiB) Viewed 540 times

I initially thought this was an issue with my provider, but after checking it appears the Template is making a call to www.meteotemplate.com/template/menu.txt and the WEDOS prompt is coming from the Meteotemplate site.

Not sure how to stop this as now my URL is flagged somehow with a provider that I have no control over. Also not sure why the template is making a call out to meteotemplate.com either. Until I figure this out, none of my menu options are visible.

Any thoughts on what the next steps should be?

Thanks!

Jay

[davidefa]

Check the menu.php file in your meteotemplate root directory ( or simply replace it with the original one of meteotemplate 19.0 )

P.S.
Noted also some other 'changes' in meteotemplate server:
- the /web/latestVersions.txt, /web/blockVersions.txt, /web/pluginVersions.txt file are now gzipped ( and today, wedos security is now preventing me from downloading from my meteotemplate pages/server ),

[MonyMony]

That was it!

The entire file was completely overwritten with all that WEDOS nonsense. Not sure how that was even possible! Fortunately I just taken my monthly full site backup so restoring that file was straight forward.

Thank you for pointing me there as I had been focused on the menu.txt file and the ..\admin\menu files and not this particular PHP.

Still concerning that if I try to update anything on my menus, I can managing to corrupt the menu.php file. Still seems like that WEDOS used by Meteotemplate.com and the linked menu.txt file is somehow behind the root of this issue. At least now I can get things back to normal.

Also, I have learned that my menu update was OK after clicking SAVE, just needed to replace the menu.php file as it is corrupting each time. Very strange behavior!


Jay

[davidefa]

Still concerning that if I try to update anything on my menus, I can managing to corrupt the menu.php file. Still seems like that WEDOS used by Meteotemplate.com and the linked menu.txt file is somehow behind the root of this issue. At least now I can get things back to normal.

Also, I have learned that my menu update was OK after clicking SAVE, just needed to replace the menu.php file as it is corrupting each time. Very strange behavior!


Jay

There is a 'strange behaviour of meteotemplate' ( I noted some time ago ):
- when you save your menu, the file menu.php is automatically downloaded from meteotemplate site and overwritten too ( maybe this was useful in the initial stages of meteotemplate development, but now I think is not strictly needed )
- also the 'update menu' button do the same thing ( but in this case only 'on demand' ), so this is perfectly ok

The attached script remove the behaviour noted in the first point ( simply unzip it in admin/menu folder )

P.S.
The 'update menu' button still download the menu.php file from meteotemplate ( and should still 'destroy' it, courtesy of wedos security ; - )

[MonyMony]

Thank You!

Strange behavior indeed!

There is a 'strange behaviour of meteotemplate' ( I noted some time ago ):

[Sperry Russ]

This Wedos popup and problem happened to me 2 days ago. I haven't done anything to the menu since I installed Meteotemplate several years ago. I am on the current V 19.0. But when I did make the slight change on the menu and clicked the update button then it appeared.

My web host provider found the problem that the menu.php file had been overwritten. The corrupted menu.php file is a html document with a little php code in it. But, he didn't know what caused it. He restored the menu.php file with a server backup and everything was back to normal.

So I kept a copy of the legitimate file. The next day I tried a menu update again and the same thing happened. I restored it with the legitimate file and back to normal.

So I have searched online for hours and found that people are hijacking browsers, CMS's and similar php software, mimicking DDos protection companies. Apparently they somehow receive payment out of all these notification clicks. I'm not sure if I totally understand all of what they are saying about it.

Here are a couple of the sites I found where you can read about it:

https://www.malwarebytes.com/blog/news/ ... ll-malware

https://keepaware.com/blog/browser-noti ... on-mimicry

There is a 'strange behaviour of meteotemplate' ( I noted some time ago ):
- when you save your menu, the file menu.php is automatically downloaded from meteotemplate site and overwritten too ( maybe this was useful in the initial stages of meteotemplate development, but now I think is not strictly needed )
- also the 'update menu' button doe the same thing ( but in this case only 'on demand' )

The attached script removes the behaviour noted in the first point ( simply unzip it in admin/menu folder )
P.S.
The 'update menu' button still downloads the menu.php file from meteotemplate ( and should still 'destroy' it, courtesy of wedos security ; - )

How did you find that it is being downloaded from Meteotemplate? That means that this Malware is coming from Meteotemplate.com? I looked at your menuSaveTabContent.zip but I only know a little bit about php code. How does this solve the problem of it coming from Meteotemplate.com?

If it is coming from there Jachym, the developer, needs to solve the problem.

[davidefa]

As I understand it, it is not a malware, it is the "wedos security" ( installed on the meteotemplate server, to protect it ), that 'chimes in' and flags the download of the menu.php script as improper ( this happens every time you modify a menu ).
As said I think that this download is unnecessary ( moreover now that the wedos security corrupts it ), so the above mod should fix this issue.

[kratochh]

Good morning
I faced the same ugly WEDOS issue yesterday and after checking here and my server I found that the menu defining text files were deleted - no clue how that happened.
Anyway thx to davidefa's hints I was able to restore the files and remove the issue.
I completely restored/admin/menu/ from my backup and a clean menu.php - that resolved it.
Best regards

[Sperry Russ]

Well looks like I over reacted to this. Before I posted my previous contents I sent an email to Wedos support with the menu.php file and the overwritten one. This morning I received a reply from them. They had a problem and corrected it. I tested it this morning and everything is working correctly. So the the patched actions are not necessary.

Here is a copy of his reply:

Hello,
thank you for the detailed description and the attached files — that helped a lot.

Based on our investigation, this was not malware and it was not caused by your hosting provider. What happened is the following:

Your script attempted to download a file (/template/menu.txt) from a target that is protected by our Layer 7 WAF (Web Application Firewall). Instead of receiving the expected file content, the request was incorrectly served our PoW (Proof-of-Work) / human verification challenge, which is normally displayed only to browsers.

As a result, the HTML content of that challenge page was saved locally under the name menu.php, which explains why:

- the file contained only HTML (no PHP code)
- it included references to WEDOS
- and the banner appeared on your website

Yesterday we experienced temporary technical issues where some legitimate, non-browser requests were incorrectly challenged by the WAF. This issue has already been identified and fixed on our side.

To summarize:
- This was not malware impersonating WEDOS.
- No malicious code was injected into your system.
- The issue was caused by an unintended WAF challenge being returned instead of the requested file.

The problem should no longer occur.

If you notice anything similar again, please let us know immediately and include the timestamp of the request.


Best regards,

Ivan Sárközi

WEDOS / Customer support 24/7/365

E-mail: support@wedos.com
URL: https://www.wedos.com/
Status page: https://wedos.status.online/en/