Salt Key Update Broke Website

Resolved sangfroidweb
(@sangfroidweb)

1 year, 4 months ago

Hi,
I think there’s a bug in the salt update feature. I’m not sure if we set it or it’s set by default but the plugin has a feature that updates the salt keys automatically on a schedule. Our website just went down and when we figured out why it’s because one of the salt keys was set to this:

define(‘AUTH_SALT’, ‘_{deNP\d(..9`Q.}/[s@)dQ[qn{1R|[S5IyLt0_gM”dYv/;w.\lDnCC_Z~oy0r\’);

Note the the last character in the salt string is a \ . The \ right before the ‘ seems to be escaping the ‘ therefore keeping the string open, which leads to a php error for the missing closing parenthesis, which php doesn’t see because it thinks it’s part of the string.

Sucuri needs to fix this bug so it doesn’t break any other websites. We’ve deactivated that feature for now ( go to Sucuri/Settings/Post Hack tab to disable it ) , and I would suggest everyone does until they fix that bug.

Viewing 8 replies - 1 through 8 (of 8 total)

Plugin Support sucuri1
(@sucuri1)

1 year, 4 months ago

@sangfroidweb Our engineering team has been notified about this and will do more reseach to try and replicate the issue. The salts are coming from this official WordPress API: https://api.wordpress.org/secret-key/1.1/salt/

Thread Starter sangfroidweb
(@sangfroidweb)

1 year, 3 months ago

Ahh.. so you guys just get it from that generator? Interestingly we’ve never had it happen before, but today, it just happened again on a different site we manage. Thanks for passing the info along to your engineering team!

bichant
(@bichant)

1 year, 3 months ago

I have had the same thing happen three times in less than two months. Sucuri is an excellent plugin, but this needs to be fixed.
Adendum
(@adendum)

1 year, 3 months ago
Over the weekend the LOGGED_IN_KEY acquired *\ as the last two characters. This made the remaining lines become commented out lines and thus broke wp-config. Replaced the first 8 SALT keys and all was OK. SG support contacted but was unable to find a cause. SUCURI automatically updates!!! Found the auto update on Jan 25th at 17:37.
```
/* define('AUTH_KEY',          'Yh1$64#i#ZojY<7-o;WQ]{QqLanI~x^n]T%!I~>-~f[A<UeU\9BC|._27BB7"L?');
/* define('SECURE_AUTH_KEY',   '{tLHSI{6(1Q}$5EZvRO 2&ql>jGF6~275p{S.S@t D)BjfAE%X_.D54|CUVz lA{');
/* define('LOGGED_IN_KEY',     'T>>,yVXA&A!8"Voa&hHb@qsrtEhnW2F0o}nm( vp({_ ,Pfg,Wkb-j|{FGLz,*\');
/* define('NONCE_KEY',         'c^NGvisjljcl|A)G:p=S9"66UL5"R0|>WJo@5M=unZ@X\WYv0XfuWk;foQ<}Ca4\');
/* define('AUTH_SALT',         'q](;W\/&ovyl~(M-VQYPF3hLTFG9:"I@AGm+5^)"u]|)zPdfy~,/dCPAWR}"QCFi');
/* define('SECURE_AUTH_SALT',  '$vt%k>ozs5prh!lc;r@|@ioXV 2!U;|sv]Z<Ktn[fZG-F~26s%jq[1i(nF(.+');
/* define('LOGGED_IN_SALT',    '@8+X1mzFxo^p%n|jftEe3a=nF5\]4bg^1}nU%q^z^lF#O)VT}^I$FWMAgO,{Y}');
/* define('NONCE_SALT',        'YkGPaZj=p^Zr_r.$?=ECA.pzxTZi<(7Jm~CWcS5N&Z8hVeTW)YYePK^?lbubK+:<');
/* define( 'WP_CACHE_KEY_SALT', 'zeYkD>*K%6BV#oGMI6h Q<=44V+{eqq_#NFhN3FVOBmT{)MKB>m,*Xh9a?C+Oc~' );
 */
```
- This reply was modified 1 year, 3 months ago by Adendum.
- This reply was modified 1 year, 3 months ago by Adendum. Reason: tidy paragraph text
- This reply was modified 1 year, 3 months ago by Adendum.
- This reply was modified 1 year, 3 months ago by Adendum.
- This reply was modified 1 year, 3 months ago by Adendum. Reason: Remove in code
Thread Starter sangfroidweb
(@sangfroidweb)

1 year, 3 months ago

Hey,
@bichant where are you hosted? The sites we’ve had this issue with are at Siteground, and @adendum seems like they might be hosted there, too since they mention reaching out to Siteground support. So I was wondering if you were too? Sucuri support mentioned that they get the salts from the official salt generator at https://api.wordpress.org/secret-key/1.1/salt/ so I can’t imagine that where you’re hosted could have anyting to do with it.. unless they have some script that intervenes when sucuri rewrites the salts with the new ones from the generator… but since I noticed @adendum and us seem to be at Siteground, I wondered if you were too? If so maybe that will help us get to the bottom of this. FYI I was just checking this thread because it just happened to us again today…

Adendum
(@adendum)

1 year, 3 months ago

I can confirm that the issue occurred on Siteground. I have over a dozen sites using Sucuri on Siteground and have been for several months but this is the first time the SALTS auto update killed my wp-config.php and brought a site down.

Plugin Support sucuri1
(@sucuri1)

1 year, 2 months ago

@sangfroidweb @adendum @bichant Thank you for your patience, we’ve fixed the above issue with our latest update 1.9.9.

Adendum
(@adendum)

1 year, 2 months ago

Many thanks @sucuri1

Viewing 8 replies - 1 through 8 (of 8 total)

The topic ‘Salt Key Update Broke Website’ is closed to new replies.