While checking an Alibaba Cloud account, I noticed a security warning in the console. Another warning appeared in the ECS section as well. At first, it looked like the server might have been compromised, but the alert was ultimately related to a WordPress vulnerability.
The warning itself did not appear to indicate a serious intrusion. After checking the issue further, it seemed to be caused by the configuration of a WordPress file. The suggested fix was to edit the relevant code manually. Alibaba Cloud users with the Cloud Shield Professional edition may also have access to a one-click repair option.
Before making any changes, connect to the ECS instance through SSH or a BT panel. It is a good idea to create a backup of the file first, so the original can be restored if anything goes wrong.
The file that needs to be edited is http.php. Search for the following code:
$same_host \= strtolower( $parsed_home\[‘host’\] ) \=\=\= strtolower( $parsed_url\[‘host’\] );
Replace it with:
$same_host \= (strtolower( $parsed_home\[‘host’\] ) \=\=\= strtolower( $parsed_url\[‘host’\] ) ‘localhost’ \=\= strtolower($parsed_url\[‘host’\]));
There is another section that must be changed. Locate:
if ( 127 \=\=\= $parts\[0\] 10 \=\=\= $parts\[0\] 0 \=\=\= $parts\[0\]
Then replace it with:
if ( 127 \=\=\= $parts\[0\] 10 \=\=\= $parts\[0\] 0 \=\=\= $parts\[0\] 0 \=\=\=$parts\[0\] “
Save the file after making both edits. Return to Alibaba Cloud and run the verification again. Once the check completed, the security warning was no longer displayed.