My site is built using Sage 9 and Bedrock. We use Woocommerce and Wordfence for security.
Last Friday the 21st we had a prolonged period where the site was unavailable giving 500 error responses, and upon talking to the our server host support was informed that we had what appeared to be a large scale ‘brute force’ attack.
During the 1 and a half hours the attack was going on, the php_error log grew to around 5mb and all of the entries for the period are similar if not identical to this:
[21-Aug-2020 20:06:47 Europe/London] PHP Warning: file_exists() expects parameter 1 to be a valid path, string given in /home/myroot/public_html/app/plugins/wordfence/vendor/wordfence/wf-waf/src/lib/storage/file.php on line 439
[21-Aug-2020 20:06:47 Europe/London] PHP Warning: file_exists() expects parameter 1 to be a valid path, string given in /home/myroot/public_html/app/plugins/wordfence/vendor/wordfence/wf-waf/src/lib/storage/file.php on line 439
[21-Aug-2020 20:06:47 Europe/London] Unable to open
[21-Aug-2020 20:06:47 Europe/London] PHP Fatal error: Uncaught Dotenv\Exception\InvalidFileException: Failed to parse dotenv file due to an invalid name. Failed at [¸÷òeá in /home/myroot/vendor/vlucas/phpdotenv/src/Parser.php:73
Stack trace:
#0 /home/myroot/vendor/vlucas/phpdotenv/src/Parser.php(29): Dotenv\Parser::parseName('\xB8\xF7\xF2\e\xE1\x7F\x00\x00\x06\x00\x00\x00\x00\x00\x00...')
#1 /home/myroot/vendor/vlucas/phpdotenv/src/Loader.php(169): Dotenv\Parser::parse('')
#2 /home/myroot/vendor/vlucas/phpdotenv/src/Loader.php(107): Dotenv\Loader->processEntries(Array)
#3 /home/myroot/vendor/vlucas/phpdotenv/src/Loader.php(91): Dotenv\Loader->loadDirect('DB_NAME=mydb...')
#4 /home/myroot/vendor/vlucas/phpdotenv/src/Dotenv.php(123): Dotenv\Loader->load()
#5 /home/myroot/vendor/vlucas/phpdotenv/src/Dotenv.php(80): Dotenv\Dotenv->loadData()
#6 /home/myroot/config/application.php(29): Dotenv\Dotenv->load()
#7 /home/myroot/public_html/wp-config.php(8): require_once('/home/myroot...')
#8 /home/myroot/public_html/wp/wp-load.php(42): in /home/myroot/vendor/vlucas/phpdotenv/src/Parser.php on line 73
I’m just trying to understand how a brute force attack would result in the above errors - or is something else going on here maybe??
That’s odd! Do you know if the .env value had different values than it currently does during the time of attack? Do you happen to have any of the webserver access logs from around this time as well, to see which URLs were getting hit?