Cory Marsh

{
    "slug": "bitfire",
    "pattern": "hardcoded_ip_url",
    "kind": "builtin",
    "version": "5.0.9",
    "hit_count": 3,
    "first_hit": {
        "file": "src/util.php",
        "line": 3429,
        "snippet": "$url      = 'https://1.1.1.1/dns-query?name=' . urlencode($query) . '&type=PTR';"
    },
    "explanation": "plugin source hardcodes a raw IPv4 URL (e.g. `https://94.156.79.8/...`) \u2014 legitimate plugins use DNS hostnames because IPs change. Hardcoded IPs in plugin code are almost always either dev leftovers or attacker C2 infrastructure. The June 2024 social-warfare keylogger (audit #14) used `https://94.156.79.8/sc-top.js` for the JS payload host, `/AddSites` for victim registration, `/CMSUsers` for filesystem-recon exfil. Operator infrastructure on raw IPs avoids domain registration / RDAP detection paths. Post-filtered to skip RFC1918/loopback/link-local ranges and `vendor/`/`tests/` paths."
}

{
    "slug": "bitfire",
    "previous_version": "4.8.2",
    "current_version": "5.0.9",
    "new_findings": [
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "src/dashboard/threat_hunter.php",
            "line": 1795,
            "snippet": "$reasons[] = 'eval()';",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "src/dashboard/threat_hunter.php",
            "line": 3213,
            "snippet": "['/\\beval\\s*\\(/i',                              'eval()',               'danger'],",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "src/dashboard/threat_hunter.php",
            "line": 3229,
            "snippet": "'eval(',",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "src/dashboard/threat_hunter.php",
            "line": 3450,
            "snippet": "$excerpt_clause = content_like_clause('post_excerpt', ['<script', 'javascript:', 'eval(']);",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "src/dashboard/threat_hunter.php",
            "line": 3809,
            "snippet": "$tn_clause = content_like_clause('t.name', ['<script', 'javascript:', 'eval(']);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/dashboard/threat_hunter.php",
            "line": 1799,
            "snippet": "$reasons[] = 'base64_decode()';",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "src/dashboard/threat_hunter.php",
            "line": 1803,
            "snippet": "$reasons[] = 'gzinflate()';",
            "confidence": "medium"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/util.php",
            "line": 3429,
            "snippet": "$url      = 'https://1.1.1.1/dns-query?name=' . urlencode($query) . '&type=PTR';",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/util.php",
            "line": 3475,
            "snippet": "$url      = 'https://1.1.1.1/dns-query?name=' . urlencode($hostname) . '&type=A';",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/util.php",
            "line": 3523,
            "snippet": "$url      = 'https://1.1.1.1/dns-query?name=' . urlencode($hostname) . '&type=AAAA';",
            "confidence": "high"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/wpcli.php",
            "line": 271,
            "snippet": "$encoded = base64_decode($data['data'] ?? '');",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/wpcli.php",
            "line": 285,
            "snippet": "$encoded = base64_decode($data['data'] ?? '');",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "src/cms2.php",
            "line": 1807,
            "snippet": "T_EVAL           => 'eval()',",
            "confidence": "medium"
        }
    ],
    "new_finding_count": 13
}