2

We have a website (ASP.NET/Plesk 9.5.5) that can be accessed just fine through the regular URL (http://example.com).

However when accessing the site through https://example.com the site displays the invalid security certificate warning, which is fine since we don't have an SSL certificate. If I add an exception, I'm sent to a completely separate site that is apparently hosting a malware script (I'm still on https://example.com though).

Because of this Google has flagged the site as dangerous.

I can't find anything in the Plesk panel that would help fix this, and as far as I can tell those files don't exist on our server. How do I tell where the https:// link is sending me? I'm not that familiar with DNS, but is that what is causing this behavior?

9
  • Firebug or Fiddler might be what you are looking for. You can watch the communication back and forth with the server. It sounds like Cross-site scripting perhaps. Jul 5, 2012 at 21:14
  • @Somantra, according to Firebug it's hitting the correct IP address on port 443. It's just not going to our site.
    – Brandon
    Jul 5, 2012 at 21:16
  • Can you explain more why you think there is malware? Look at this post and watch it load the suspect site you describe in the post: stackoverflow.com/questions/4229330/… Jul 5, 2012 at 21:19
  • @Somantra, Google sent us an email saying it flagged the site as downloading a malicious js file. Checking the Google search results for our site, it is indeed flagged. Firefox and Chrome both display malware warnings due to this. Inspecting the Firebug tab, the site is loading from the correct IP address on port 443. But the content isn't ours, the files it's loading from our server don't actually exist on our server.
    – Brandon
    Jul 5, 2012 at 21:22
  • Look at the Net tab in Firebug and then load the page. You should see each element of the page loading and where it came from etc. Jul 5, 2012 at 21:23

2 Answers 2

2

The reason this is happening is because your hosting provider has more than one (probably hundreds or even thousands) of websites all sharing the same IP address. This is perfectly fine and normal.

Catch is that "normal" SSL can only support one website per IP address. So every single website that shares that IP address will all display the same website on https://.

It would appear that the default HTTPS:// website that is hosted by your host on your IP address has this vulnerability.

There's nothing that you can do about this; this is just a pitfall to shared hosting. As Somantra states you need to contact your hosting provider.

1
  • that is a good explanation of why it only affects HTTPS, I didn't think of that. Jul 5, 2012 at 23:11
0

This appears to be a javascript injection xss attack that exploits a vulnerability in plesk.

According to the article you linked, the injection appears to append code to existing js files.

I would strongly suggest following the authors advice to contact your hosting provider about the attack and change your passwords.

There is a patch for the vulnerability, so I'd do that ASAP as well.

It won't help all that much but to answer your question about determining the redirect URL:

Use netstat to observe the attempted connections to the apparent xss site.

I like to use netstat like this:

netstat -noab >>out.txt

Then open the out.txt when it finishes and search around for what you need.

You could remove some of the output clutter with something like:

netstat -noab | find /i ":80"

or

netstat -noab | find /i ":443"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .