I have an up-to-date Wordpress install, and I've tried to do due diligence when it comes to security. However I'm having a recurring problem.
I've put my config at the level above my install location.
However every so often something writes a new
wp-config.php to the install location, filled with someone's details.
I've analysed my Apache access logs and I'm seeing this:
[IP removed] - - [22/Nov/2019:17:45:06 +0100] "POST /wordpress//wp-admin/setup-config.php?step=2 HTTP/1.1" 200 1116 "-" "python-requests/2.9.1" [IP removed] - - [22/Nov/2019:17:45:09 +0100] "POST /wordpress//wp-admin/install.php?step=2 HTTP/1.1" 302 368 "-" "python-requests/2.9.1" [IP removed] - - [22/Nov/2019:17:45:09 +0100] "GET /wordpress/wp-admin/setup-config.php HTTP/1.1" 200 1487 "-" "python-requests/2.9.1" [IP removed] - - [22/Nov/2019:17:45:10 +0100] "GET /wordpress//wp-login.php HTTP/1.1" 302 332 "-" "Python-urllib/2.7" [IP removed] - - [22/Nov/2019:17:45:11 +0100] "GET /wordpress/wp-admin/setup-config.php HTTP/1.1" 200 2791 "-" "Python-urllib/2.7"
I don't know for sure but I suspect that whatever they've managed to POST to the install stage has resulted in Wordpress creating a new config. This doesn't appear to achieve anything tangible for the attacker since they don't have valid credentials, a database or ability to create one, etc etc, but it does put in place a config that breaks the site, directing all access to the installer page.
The config produced is along the lines of this:
<?php /** * The base configuration for WordPress * * The wp-config.php creation script uses this file during the * installation. You don't have to use the web site, you can * copy this file to "wp-config.php" and fill in the values. * * This file contains the following configurations: * * * MySQL settings * * Secret keys * * Database table prefix * * ABSPATH * * @link https://codex.wordpress.org/Editing_wp-config.php * * @package WordPress */ // ** MySQL settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define( 'DB_NAME', '[removed]' ); /** MySQL database username */ define( 'DB_USER', '[removed]' ); /** MySQL database password */ define( 'DB_PASSWORD', '[removed]' ); /** MySQL hostname */ define( 'DB_HOST', 'remotemysql.com' ); [snipped]
I can probably prevent reoccurrence by setting up rules to forbid access to the installer, but surely WP shouldn't be allowing this, and I can't find anything else on the subject.
Am I missing anything in terms of either how this is happening, or what might have been gained as a result?
Edit: it seems like this needs some clarification. I believe that this is WP being induced to write a new config file to the main directory, as it would do if being newly installed. It is not modification of my config at the higher level. It does not appear to be a broader level of compromise.
As the site is non-critical at present, I've started logging request details (POST params etc) to the filesystem and we'll see what I get next time this happens, which is roughly daily.