Notice of vulnerabilities from Imunify - false positives

[dave518]

A similar event as someone else detailed in https://forum.cloudlinux.com/forum/i...erce-on-cpanel , but with WPForms Pro plugin for WordPress.


1.8.8.3 is the current version and does not have any vulnerabilities, and has been running on my user's sites since April 26. But starting on May 10, ImunifyAV started reporting an old vulnerability from 2023 as follows:

------------------
Immediate Update Needed for WordPress Security

Dear Administrator,

We've detected vulnerable WordPress versions in your system:

wpforms version 1.8.8.3 that is located at /home/user/public_html has vulnerability(s):
CVE-2023-30500
CVE-2023-7063

wpforms version 1.8.8.3 that is located at /home/user/public_html/subdomain has vulnerability(s):
CVE-2023-30500
CVE-2023-7063

wpforms version 1.8.8.3 that is located at /home/user/public_html/subdomain has vulnerability(s):
CVE-2023-30500
CVE-2023-7063

wpforms version 1.8.8.3 that is located at /home/user/public_html/subdomain has vulnerability(s):
CVE-2023-30500
CVE-2023-7063

1 more items found.

Quick Steps to Secure:

Alert WordPress admin(s) to update ASAP.

Upgrade to Imunify360 for broader security coverage.

Questions? Our team is here to help.

Stay Safe,
Imunify360 Security Team
Manage subscriptions

The system generated this notice on Monday, May 20, 2024 at 7:42:43 AM UTC.

“Imunify::Generic” notifications are currently configured to have an importance of “Low”. You can change the importance or disable this type of notification in WHM’s Contact Manager at: hostname:2087/scripts2/editcontact?event=Application

Do not reply to this automated message.
-------------------

Also seems strange that the support team links in these messages link to https://www.imunify360.com/newsletter-thank-you/ (with an added unique ID on the end) which takes me to a "Thank you! You have signed up for our newsletter." page.

I know I could just disable the alerts, but I would much rather know if / when / why ImunifyAV is reporting incorrectly.

Thanks for any assist!

[alevchenko]

Hi, Dave
Sorry for the delay, needed some time to clarify the information about this with our devs.

Please be informed that this issue is known to our team and we already have an internal task to fix incorrect vulners data for WordPress plugins. ETA for fix is about a month, so for now you can ignore it or disable notifications as described at https://blog.imunify360.com/how-to-m...-notifications

[alevchenko]

Hi, Dave
Sorry for the delay, needed some time to clarify the information about this with our devs.

Please be informed that this issue is known to our team and we already have an internal task to fix incorrect vulners data for WordPress plugins. ETA for fix is about a month, so for now you can ignore it or disable notifications as described at https://blog.imunify360.com/how-to-m...-notifications

[dave518]

alevchenko - Thanks very much for the response and update! I had tried to submit a support ticket on this, since the issue also occurs with at least one other perfectly safe plugin and I host hundreds of WP sites using these plugins (which means huge numbers of these email alerts being generated), BUT - I'm unable to submit a ticket because I have just the free ImunifyAV at the moment.

I did read at https://cloudlinux.zendesk.com/hc/en...rabilities+fro m+Imunify+-+false+positives that this command can be used to submit a report:

# imunify-antivirus submit false-positive <full_path_to_file> --reason <reason>

However, the email alerts do not name a specific file. They simply name the folder of all the WordPress installs themselves (such as public_html in most cases). And even if there were a path to file in the reports, I it seems unclear as to what put in for the <reason> operative.


So, if you don't mind please, I have just two questions:

1. Will the upcoming fix be applied to ImunifyAV as well, or only Imunify360?

2. Does the upcoming fix address all modern WP plugins, or do we need to somehow report a list of the ones this is happening with?

Thank you for your valuable help, I truly appreciate it.

[alevchenko]

Hi Dave,

Sorry to hear that.

I it seems unclear as to what put in for the <reason> operative.

The reason argument is not obligatory for the command to submit a false-positive file. It is enough to specify the path only but optional is to add a short reason/description if possible.

However, the email alerts do not name a specific file.

Moreover, there is no reason to report this files since the issue is known to our dev team alrady.

Will the upcoming fix be applied to ImunifyAV as well, or only Imunify360?

Yes, the upcoming fix will affect both ImunifyAV and Imunify360 products because they share a common malware signatures database.

Does the upcoming fix address all modern WP plugins, or do we need to somehow report a list of the ones this is happening with?

It covers known vulnerabilities (announced on the web) of known WordPress plugins which is also compounded with the malware database which is constantly extended by our dev team researching logs and unique reported cases. However, if you notice any suspicious files you believe should be detected, you can always submit them using the CLI tool suggested here https://cloudlinux.zendesk.com/hc/en...rabilities+fro

Also, you can ensure if you are running the latest version of Imunify, you can refer to this changelog page: https://changelog.imunify.com/imunify-av