Tweet
Bonjour,
Je passe par un outil (gratuit à l'origine mais payant maintenant )
pour tester mon site régulièrement ...
Depuis 1 semaine, j'ai un message qui m'indique que j'ai une faille potentielle importante !
Bon j'ai essayé de modifier mon .htaccess pour supprimer cette faillle utilisant à priori
des composants de recherche Joomla ? (je peux me tromper là-dessus)
Un extrait de mon .htaccess avec la partie en "gras" = tentative de correction
(je ne suis pas spécialiste en syntaxe "Apache")
J'ai aussi essayé de désactiver tout possibilité de recherche sur mon site (désactivation plug-in search)
(la recherche n'est pas utile sur mon site)
Le message demeure ... le dernier module installé sur mon site est "Abi*via*Multi*Twitter" et
j'ai aussi des doutes sur la relation entre ce dernier module et cette nouvelle faille ?
Si quelqu'un peut m'aiguiller ou voit ce que ça peut bien être
CI-dessous la faille détectée ...
Je passe par un outil (gratuit à l'origine mais payant maintenant )
pour tester mon site régulièrement ...
Depuis 1 semaine, j'ai un message qui m'indique que j'ai une faille potentielle importante !
Bon j'ai essayé de modifier mon .htaccess pour supprimer cette faillle utilisant à priori
des composants de recherche Joomla ? (je peux me tromper là-dessus)
Un extrait de mon .htaccess avec la partie en "gras" = tentative de correction
(je ne suis pas spécialiste en syntaxe "Apache")
Code:
...
# KILL THEM ETAGS
Header unset Pragma
FileETag None
Header unset ETag
IndexIgnore *
## Mod_rewrite in use.
RewriteEngine On
Options +FollowSymLinks All
ServerSignature Off
## Begin - Rewrite rules to block out some common exploits.
# This attempts to block the most common type of exploit `attempts` to Joomla!
# Block out any script trying to base64_encode data within the URL.
RewriteCond %{QUERY_STRING} base64_encode[^(]*\([^)]*\) [OR]
# Block out any script that includes a <script> tag in URL.
RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
# Block out any script trying to set a PHP GLOBALS variable via URL.
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
# Block out any script trying to modify a _REQUEST variable via URL.
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
# Return 403 Forbidden header and show the content of the root homepage
RewriteRule .* index.php [F]
## End - Rewrite rules to block out some common exploits.
## Begin - Joomla! core SEF Section.
#
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
#
# If the requested path and file is not /index.php and the request
# has not already been internally rewritten to the index.php script
RewriteCond %{REQUEST_URI} !^/index\.php
# and the request is for something within the component folder,
# or for the site root, or for an extensionless URL, or the
# requested URL ends with one of the listed extensions
RewriteCond %{REQUEST_URI} /component/|(/[^.]*|\.(php|html?|feed|pdf|vcf|raw))$ [NC]
# and the requested path and file doesn't directly match a physical file
RewriteCond %{REQUEST_FILENAME} !-f
# and the requested path and file doesn't directly match a physical folder
RewriteCond %{REQUEST_FILENAME} !-d
# internally rewrite the request to the index.php script
RewriteRule .* index.php [L]
#
## End - Joomla! core SEF Section.
RewriteCond %{QUERY_STRING} \=PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC]
RewriteRule .* - [F]
[B]#20141113
RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC,OR]
RewriteCond %{THE_REQUEST} (\\r|\\n|%0A|%0D) [NC,OR]
RewriteCond %{HTTP_REFERER} (<|>|’|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %{HTTP_COOKIE} (<|>|’|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %{REQUEST_URI} ^/(,|;|:|<|>|”>|”<|/|\\\.\.\\).{0,9999} [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (libwww-perl|curl|wget|python|nikto|scan) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (<|>|’|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
#20141113
[/B]
# 20140121 Block mySQL injects
RewriteCond %{QUERY_STRING} (;|<|>|’|”|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark) [NC,OR]
RewriteCond %{QUERY_STRING} \.\./\.\. [OR]
RewriteCond %{QUERY_STRING} (localhost|loopback|127\.0\.0\.1) [NC,OR]
RewriteCond %{QUERY_STRING} \.[a-z0-9] [NC,OR]
RewriteCond %{QUERY_STRING} (<|>|’|%0A|%0D|%27|%3C|%3E|%00) [NC]
# 20140121 Note: The final RewriteCond must NOT use the [OR] flag.
J'ai aussi essayé de désactiver tout possibilité de recherche sur mon site (désactivation plug-in search)
(la recherche n'est pas utile sur mon site)
Le message demeure ... le dernier module installé sur mon site est "Abi*via*Multi*Twitter" et
j'ai aussi des doutes sur la relation entre ce dernier module et cette nouvelle faille ?
Si quelqu'un peut m'aiguiller ou voit ce que ça peut bien être
CI-dessous la faille détectée ...
Vulnerabilities in Custom Web Code (High)
We discovered vulnerabilities in the scripts listed below. Next to each script, there is a description of the type of attack that is possible, and the way to recreate the attack. If the attack is a simple HTTP GET request, you can usually paste it into your browser to see how it works. If it's a POST attack, the parameters for the POST request will be listed in square parenthesis.
Blind SQL Injection
URL: http://www.DOMAINE.com/
Affected Parameter: task
Vector Used: VALUE';WAITFOR DELAY '00:00:24';--
Pattern found: Timing test
Complete Attack: http://www.DOMAINE.com/ [searchword=Search... &task=search';WAITFOR DELAY '00:00:24';-- &option=com_search &Itemid=754]
Show Test Sample
URL: http://www.DOMAINE.com/?
Parameter name: searchword
Parameter name: task
Parameter name: option
Parameter name: Itemid
Recommended Solution:
* SQL Injection:
Use stored procedures to prevent attackers from altering the queries, and filter user input to discard invalid characters such as '
* Cross Site Scripting:
Filter user input to discard characters such as < and >. Make sure your server does not display error messages that contain input received from the user.
* Source Disclosure:
Make sure all debugging information is turned off from production servers. Scripts should be configured to be executables only, with no ability for a user to view them.
* Non-SSL login:
All login pages should be SSL protected (e.g. have an https:// link). When using non-SSL protected pages eavesdroppers might be able to capture usernames and passwords
* Sensitive information sent over non-encrypted page:
Make sure all sensitive information is sent over SSL-protected pages.
Impact:
Attackers can take control over your database, and in some cases over the operating system (using master..xp_cmdshell, CREATE LIBRARY, etc).
More information:
See
http://www.securiteam.com/securityre...DP0N1P76E.html,
http://www.securiteam.com/securityre...UP010A6AA.html,
http://www.securiteam.com/securityre...IP030K8AA.html,
http://www.securiteam.com/securityre...GP0E2K7FO.html,
http://www.owasp.org/index.php/Guide_to_SQL_Injection,
and ...
We discovered vulnerabilities in the scripts listed below. Next to each script, there is a description of the type of attack that is possible, and the way to recreate the attack. If the attack is a simple HTTP GET request, you can usually paste it into your browser to see how it works. If it's a POST attack, the parameters for the POST request will be listed in square parenthesis.
Blind SQL Injection
URL: http://www.DOMAINE.com/
Affected Parameter: task
Vector Used: VALUE';WAITFOR DELAY '00:00:24';--
Pattern found: Timing test
Complete Attack: http://www.DOMAINE.com/ [searchword=Search... &task=search';WAITFOR DELAY '00:00:24';-- &option=com_search &Itemid=754]
Show Test Sample
URL: http://www.DOMAINE.com/?
Parameter name: searchword
Parameter name: task
Parameter name: option
Parameter name: Itemid
Recommended Solution:
* SQL Injection:
Use stored procedures to prevent attackers from altering the queries, and filter user input to discard invalid characters such as '
* Cross Site Scripting:
Filter user input to discard characters such as < and >. Make sure your server does not display error messages that contain input received from the user.
* Source Disclosure:
Make sure all debugging information is turned off from production servers. Scripts should be configured to be executables only, with no ability for a user to view them.
* Non-SSL login:
All login pages should be SSL protected (e.g. have an https:// link). When using non-SSL protected pages eavesdroppers might be able to capture usernames and passwords
* Sensitive information sent over non-encrypted page:
Make sure all sensitive information is sent over SSL-protected pages.
Impact:
Attackers can take control over your database, and in some cases over the operating system (using master..xp_cmdshell, CREATE LIBRARY, etc).
More information:
See
http://www.securiteam.com/securityre...DP0N1P76E.html,
http://www.securiteam.com/securityre...UP010A6AA.html,
http://www.securiteam.com/securityre...IP030K8AA.html,
http://www.securiteam.com/securityre...GP0E2K7FO.html,
http://www.owasp.org/index.php/Guide_to_SQL_Injection,
and ...
sur le site en question 
Commentaire