#Users getting Browser Integrity Checks randomly on an API subdomain that has all security disabled.

1 messages · Page 1 of 1 (latest)

tawdry isle
#

What is the site? If the challenge pages asks users to run a command prompt, it's a fake challenge page installed on your site to compromise visitors.

knotty ledge
tawdry isle
#

Fake challenges don't show for all users, usually only Windows, or can be configured to be more precisely targetted. It's always worth suggesting if you are getting challenges that are unexpected. Check your security event log to see if and why a real challenge is issued... https://dash.cloudflare.com/?to=/:account/:zone/security/events

knotty ledge
tawdry isle
#

If a request is blocked or challenged by Cloudflare it will be in your security event log.

knotty ledge
#

yes that is the thing thats baffling me

#

Well i wish i could get in touch with a CF technician through a ticket, because i have no doubt this is coming from CF

#

as i mentioned everything was fine until they reworked the rules dashboard etc

tawdry isle
#

It's easier to check the site directly. If you don't want to give it publicly you can put it in here... https://cf.sjr.dev/tools/check and give the first 8 digits of the test UUID then I can look it up.

#

The site loads blank for me. I don't see a challenge but there is this ⁨x-powered-by: PHP/7.0.33⁩ - that's very old, unsupported and has active exploits in the wild so even without the challenge issue, you need to update your PHP version.

knotty ledge
#

and thanks for pointing out the PHP version ill get on that asap

#

but yes, for 99% of users its fine, but every other day new users contact me with issues and i can't figure out what to do. I'm sure if i just used the DNS on the subdomain and not route, it would be fine

#

but i dont want to expose the subdomain

tawdry isle
#

If it happens for a user, get them to send you the full HTML including the ray ID. Then you can look up the ray ID in the security event log to see if it is there.

midnight thorn
#

ok to be clear, that HTML you shared is not a cloudflare challenge page.

#

unless you have customized it, which I doubt

knotty ledge
#

also, usually i ask users to reset their modem and get a new IP, or use a mobile hotspot, and it works for them

midnight thorn
#

no it doesn't make sense front and back

knotty ledge
#

but some have static ip's

midnight thorn
#

that CSS isn't in the challenge page

#

given the cf-cache-status: DYNAMIC header, that is also 100% coming from your origin

#

your origin is compromised

knotty ledge
# 
<html lang="en">
<head>
  <meta charset="utf8">
  <meta name="viewport" content="width=device-width,initial-scale=1.0">
  <script type="37bcb42c03ecd2c9f62346f4-text/javascript">
      (function(){
          setTimeout(function(){
              window.location.reload();
          }, 5000);
      }())
  </script>
  <link rel="icon" href="data:,">
  <title>One moment, please...</title>
  <style>
.spinner {
    -webkit-animation: spin 1s ease-out;
    animation: spin 1s ease-out;
}
@keyframes spin {
    0% {
        -webkit-transform: rotate(0deg);
        -moz-transform: rotate(0deg);
        -ms-transform: rotate(0deg);
        -o-transform: rotate(0deg);
        transform: rotate(0deg);

this is cut off i had the replies limited in the log file from users

midnight thorn
#

yes but that's not how challenge pages start at all

knotty ledge
#

this only happens on the api subdomain with the app > auth request > api, api is not accessible to public wihout custom headers at all, i disabled them now for checking

#

so how do i confirm its something on origin

midnight thorn
#

go through all PHP files that are related

#

grep for "eval" or parts of the challenge page ("One moment, please...")

#

it's likely sitting somewhere highly obfuscated

#

I don't know how your server is setup or how well sandboxed it is, but you can assume your entire server and database are also compromised

knotty ledge
#

so the auth php is like 200 lines long and pretty straightforward, the functions.php included is intact, i just diffed it against a version from 2020, and only my own changes are in there

knotty ledge
midnight thorn
#

then it's somewhere else, but I have no clue about PHP

knotty ledge
midnight thorn
#

that makes perfect sense because they don't want to be detected

knotty ledge
knotty ledge
#

I added a fallback pullzone on Bunny for the api subdomain and it appears to be working fine

client > bunny api host>CNAME to cf api host> origin
cf was left enabled on the subdomain and I didn't change any rules