Virus on the MODX website - ModX.XSSI.1, who faced it?

Question

MODX

Hello!
Please help me in the following situation. The antivirus on reg.ru hosting reported that on all sites on ModX, there is a certain ModX.XSSI.1 virus, and an infected file /connectors/modx.config.js.php. I rummaged through everything, I did not find anything about this virus, what and how to do. Treatment from hosting did not give a result. On a fresh installed CMS, this virus also shows. Moreover, the contents of the files are different. This is what modx.config.js.php contains (any changes result in an empty admin), the virus message remains

<?php
/**
 * @package modx
 * @var modX $modx
 */
define('MODX_CONNECTOR_INCLUDED', 1);
define('MODX_REQP',true);
require_once dirname(__FILE__).'/index.php';
$_SERVER['HTTP_MODAUTH'] = $modx->user->getUserToken($modx->context->get('key'));
$modx->request->handleRequest(array('location' => 'system','action' => 'config.js'));

Answer 1

Hello.

Antivirus hosted reg.ru

It gives both a lot of false positives and reacts to publicly disclosed software vulnerabilities, so it's not necessarily a virus.

I rummaged through everything, I did not find anything about this virus, what and how to do.

Because it's not a virus, but a vulnerability :)
Version 2.8.2 has security updates:

• Prevent access to sensitive user data [#15678]
  
• Add permissions to enforce access to specific resource types [#15655]
  
• Flatten nested lexicon parameters by dot notation [#15490]
  
• Restrict static resources to predefined path [#15656]
  
• Prevent XSSI access to MODx.config by requiring auth token [#15644]
  

XSSI - Cross-Site Script Inclusion is your case.

Answer 2

It's not a virus, it's a vulnerability. Update your distribution to the latest version.