Security Notices - MODX Community Forums https://forums.modx.com/board/?board=8 <![CDATA[Revolution 2.6.4 and Prior Two Cricital Vulnerabilities; Upgrade Mandatory/Patch]]> https://forums.modx.com/thread/104039/revolution-2-6-4-and-prior-two-cricital-vulnerabilities-upgrade-mandatory-patch#dis-post-559514 Product: MODX Revolution
Severity: Critical
Versions: <=2.6.4
Vulnerability type(s): Remote Execution / File/Directory Deletion
Report date: 2018-Jul-11
Fixed date: 2018-Jul-12

Description
On July 11 we received notice that there are two critical vulnerabilities that include remote script execution and file/directory removal. These issues are critical in nature. It is possible for attackers to compromise the website or deface or delete files or directories.

Affected Releases
All MODX Revolution releases prior to and including 2.6.4

Solutions
  1. Upgrade to MODX Revolution 2.6.5 or above.
  2. If you're on 2.6.4 you can replace the changed files included in the commits: here (can be manually updated on versions back to 2.3.0) and here (can be updated on versions back to 2.5.2). Please note, replacing files in other versions of MODX Revolution could lead to unintended consequences. It is always preferred to upgrade.

Support
If you do not know how to upgrade your site there are several support options available. You can contact the developer or builder of your site, ask for help in the MODX Forums, find a MODX Professional or get help from the MODX Services team.

Acknowledgement
We would like to thank Ivan Klimchuk (Alroniks) and agel_nash for bringing these issues to our attention and verifying their resolution.

Additional Information
For additional information, please email MODX Support.]]>
https://forums.modx.com/thread/104039/revolution-2-6-4-and-prior-two-cricital-vulnerabilities-upgrade-mandatory-patch#dis-post-559514 Thu, 12 Jul 2018 02:34:07 +0000 https://forums.modx.com/thread/104039/revolution-2-6-4-and-prior-two-cricital-vulnerabilities-upgrade-mandatory-patch#dis-post-559514
<![CDATA[Revolution 2.5.1 and Prior Multiple Vulnerabilites]]> https://forums.modx.com/thread/101394/revolution-2-5-1-and-prior-multiple-vulnerabilites#dis-post-547025 Product: MODX Revolution
Severity: Moderate
Versions: <=2.5.1
Vulnerability type: Directory Traversal / SQL Injection
Report date: 2016-Nov-4
Fixed date: 2016-Nov-14

Description
We received notice that there are several vulnerabilities that include a SQL injection and directory traversal. These issues on their own are not critical in nature, however, it could be possible for determined attackers to combine vectors to compromise a site.

Affected Releases
All MODX Revolution releases prior to and including 2.5.1

Solutions
  1. Upgrade to MODX Revolution 2.5.2 or above.
  2. Patch available for versions 2.3.3-2.5.2 thanks to Sterc. Versions below 2.3.3 must upgrade.

Support
If you do not know how to upgrade your site there are several support options available. You can contact the developer or builder of your site, ask for help in the MODX Forums, find a MODX Professional or get help from the MODX Services team.

Acknowledgement
We would like to thank [url=modxclub.ru]Nikolay Lanetshttp://modx.com/company/contact/]MODX Contact Form" target="_blank" rel="nofollow"> and Chen Ruiqi from for bringing these issues to our attention and verifying their resolution.

Additional Information
For additional information, please use the [url=http://modx.com/company/contact/]MODX Contact Form]]>
https://forums.modx.com/thread/101394/revolution-2-5-1-and-prior-multiple-vulnerabilites#dis-post-547025 Wed, 07 Dec 2016 09:00:05 +0000 https://forums.modx.com/thread/101394/revolution-2-5-1-and-prior-multiple-vulnerabilites#dis-post-547025
<![CDATA[Evolution 1.1 and Prior Remote Execution]]> https://forums.modx.com/thread/101390/evolution-1-1-and-prior-remote-execution#dis-post-547020 Product: MODX Evolution
Risk: Very High
Severity: Critical
Versions: <=1.1
Vulnerability Type: Remote Code Execution
Report Date: 2016-November-08
Fixed Date: 2016-November-12

Description
The following components distributed with all versions of MODX Evolution (and 0.9.x) contain a vulnerability, that allows remote code execution: Ajaxsearch, eForm and evoGallery

Affected Releases
All MODX 0.9.x/Evolution releases prior to and including MODX Evolution 1.1 (with AjaxSearch, eForm or evoGallery installed) are affected.

Solution
Determine if site is compromised. Remove any malicious files or database entries. Then, upgrade to MODX Evolution 1.2 or above. See instructions below.

Support
If you do not know how to upgrade your site and complete the steps below to locate and remove malicious files and database entries, there are options. You can contact the developer or builder of your site, ask for help in the MODX Forums, find a MODX Professional or get help from the MODX Services team.

One way to determine if your site has been compromised is a new tool called Evocheck . It can help identify malicious code in files or database. We recommend using it or a similar tool in case your site has been compromised. And even after your site is secured again, this tool can be useful to find any text/code in your installation.

Please note, no detection script is perfect and exploits may change over time to hide from such detection.
Cleaning and Upgrade Instructions for Compromised Installation:


  1. Logout from manager
  2. Download latest MODX 1.2
  3. Upload package to your server via FTP, explicitly overwrite any existing file
  4. Delete file cache/siteCache.idx.php manually by hand via FTP (do NOT rely on "Clear Cache"-button inside manager), because there is a malicious Plugin likely hidden in the database that will reinfect the site
  5. Use Evocheck to check for malicious Plugins and files you wish to delete. Inside the source-code you will find strange / suspicious code seen below these instructions
  6. Remember ID of this plugin, which is probably the last added one, and use phpMyAdmin or https://www.adminer.org/ to manually delete it from table "site_plugins"
  7. IMPORTANT: Repeat steps 4 + 5 just in case changes happened meanwhile
  8. IMPORTANT: In cases the upgrade/security-fix seems not to work, there are additionally uploaded files / backdoors left on the server. Evocheck can help but still you need technical expertise to know what you are doing, i.e. using the right RegEx-terms to find malicious code. It is no one-click-solution!
  9. If your site uses eForm or AjaxSearch on your site, test their functionality as there are changes to these Extras.

Samples of Malicious Code
eval(base64_decode("cc6ebdef6a9f8fd3887455e23a2ec....
eval("base".128/2."_dec"."ode(.....)"


IMPORTANT: Last but not least, watch your server for at least a week to assure you have already found and removed all backdoors / malicious files.

NOTE
A special thanks to community members pixelchutes, cipa and pbowyer for identifying the vector and yama for the resolution. And of course, everybody else involved in sorting out this compromise.]]>
https://forums.modx.com/thread/101390/evolution-1-1-and-prior-remote-execution#dis-post-547020 Wed, 07 Dec 2016 06:56:18 +0000 https://forums.modx.com/thread/101390/evolution-1-1-and-prior-remote-execution#dis-post-547020
<![CDATA[Evo Security Patch 1.0.12 and above]]> https://forums.modx.com/thread/101240/evo-security-patch-1-0-12-and-above#dis-post-546368
You can read the release post here and you can download the patch here

All users of Evo that have the "Extras" module installed can download the patch directly via the module, as seen here.

For those who haven't installed the patch yet, Yama from the Evo DEV team posted a security release on the 24/11/2016 (Evo 1.1.1), which can be found here

If you wish to wait for the 1.2 official release feel free to do so, but at your own risk]]>
https://forums.modx.com/thread/101240/evo-security-patch-1-0-12-and-above#dis-post-546368 Mon, 14 Nov 2016 09:15:02 +0000 https://forums.modx.com/thread/101240/evo-security-patch-1-0-12-and-above#dis-post-546368
<![CDATA[Critical Login XSS+CSRF Revolution 2.2.1.4 and Prior]]> https://forums.modx.com/thread/92152/critical-login-xss-csrf-revolution-2-2-1-4-and-prior#dis-post-503298 Product: MODX Revolution
Severity: Critical
Versions: 2.0.0–2.2.14
Vulnerability type: CSRF & XSS
Report date: 2014-Jul-10
Fixed date: 2014-Jul-15

Description
A significant vulnerability was discovered in the Manager login of MODX Revolution that also affects the use of the Login Extra. A malicious user could formulate a link that automatically logs the user into their own account, then redirects the user to a site the attacker controls immediately, exposing the user's CSRF token. This can be exploited with or without getting the user to enter their credentials in the form.

Affected Releases
All MODX Revolution releases prior to and including 2.2.14.

Solution
Upgrade to MODX Revolution 2.2.15. Due to the nature of this issue and the number of files requiring changes the solution is to upgrade. No installable patch or fileset is available for prior versions.

Acknowledgement
We would like to thank Narendra Bhati, of Suma Soft for bringing this issue to our attention.

Additional Information
For additional information, please use the MODX Contact Form]]>
https://forums.modx.com/thread/92152/critical-login-xss-csrf-revolution-2-2-1-4-and-prior#dis-post-503298 Wed, 16 Jul 2014 10:02:20 +0000 https://forums.modx.com/thread/92152/critical-login-xss-csrf-revolution-2-2-1-4-and-prior#dis-post-503298
<![CDATA[Important Update to AjaxSearch Exploit in Evo 1.0.13 (and prior)]]> https://forums.modx.com/thread/91390/important-update-to-ajaxsearch-exploit-in-evo-1-0-13-and-prior#dis-post-499942 announced an exploit found in AjaxSearch that could allow a Remote Code Execution in MODX Evolution.

We originally suggested the removal of the index-ajax.php file was a sufficient method to protect your site from vulnerability. It has come to our attention that this was not correct. The correct methods to close this vulnerability are: remove all AjaxSearch files (if you don't use this snippet on your site), upgrade the AjaxSearch files to 1.10.1, or upgrade to Evolution 1.0.14.

Please share this message to ensure every Evo site owner knows.]]>
https://forums.modx.com/thread/91390/important-update-to-ajaxsearch-exploit-in-evo-1-0-13-and-prior#dis-post-499942 Tue, 10 Jun 2014 09:22:37 +0000 https://forums.modx.com/thread/91390/important-update-to-ajaxsearch-exploit-in-evo-1-0-13-and-prior#dis-post-499942
<![CDATA[MODX Evolution 1.0.13 (and prior) AjaxSearch Vulnerability]]> https://forums.modx.com/thread/91266/modx-evolution-1-0-13-and-prior-ajaxsearch-vulnerability#dis-post-499837 Product: MODX Evolution
Risk: Very High
Severity: Critical
Versions: <=1.0.13
Vulnerabilty Type: Remote Code Execution
Report Date: 2014-May-29
Fixed Date: 2014-June-5

Description
The AjaxSearch component distributed with all versions of MODX Evolution (and 0.9.x) contains a vulnerability that allows remote code execution.

Affected Releases
All MODX 0.9.x/Evolution releases prior to and including MODX Evolution 1.0.13 (with AjaxSearch installed) are affected.

Solutions
There are two ways to resolve or mitigate the issue:

  1. Upgrade AjaxSearch to version 1.10.1
  2. Upgrade to MODX Evolution 1.0.14.

NOTE
A special thanks to Semko Vitaliy for identifying the vector and community member Thomas Jakobi for the resolution.]]>
https://forums.modx.com/thread/91266/modx-evolution-1-0-13-and-prior-ajaxsearch-vulnerability#dis-post-499837 Mon, 09 Jun 2014 11:36:33 +0000 https://forums.modx.com/thread/91266/modx-evolution-1-0-13-and-prior-ajaxsearch-vulnerability#dis-post-499837
<![CDATA[MODX Revolution 2.2.13 (and prior) Blind SQL Injection]]> https://forums.modx.com/thread/90173/modx-revolution-2-2-13-and-prior-blind-sql-injection#dis-post-495452 Product: MODX Revolution
Severity: Critical
Versions: 2.0.0–2.2.13
Vulnerability type: SQL Injection
Report date: 2014-Mar-10
Fixed date: 2014-Apr-04

Description
Multiple vulnerabilities were discovered in MODX Revolution that allow users to inject and manipulate the database. This includes an issue exploitable through the session ID supplied by the user and is exploitable without authentication. Another issue relates to messaging and connectors for authenticated users.

Affected Releases
All MODX Revolution releases prior to and including 2.2.13.

Solution
Upgrade to MODX Revolution 2.2.14. Due to the nature of this issue and the number of files requiring changes the solution is to upgrade. No installable patch or fileset is available for prior versions.

Acknowledgement
We would like to thank Craig Arendt, of Stratum Security for bringing this issue to our attention.

Additional Information
For additional information, please use the MODX Contact Form]]>
https://forums.modx.com/thread/90173/modx-revolution-2-2-13-and-prior-blind-sql-injection#dis-post-495452 Mon, 21 Apr 2014 10:18:45 +0000 https://forums.modx.com/thread/90173/modx-revolution-2-2-13-and-prior-blind-sql-injection#dis-post-495452
<![CDATA[MODX Revolution 2.X SQL Injection]]> https://forums.modx.com/thread/89486/modx-revolution-2-x-sql-injection#dis-post-492046 Product: MODX Revolution
Severity: Extremely Critical
Versions: 2.0.0–2.2.12
Vulnerability type: SQL Injection
Report date: 2014-Mar-5
Fixed date: 2014-Mar-6

Description
A vulnerability was discovered in MODX Revolution that allows users to inject and manipulate the database. Attackers could exploit this to alter or destroy data in the database.

Affected Releases
All MODX Revolution releases prior to and including 2.2.12.

Solutions

  1. Upgrade to MODX Revolution 2.2.13
  2. To quickly patch 2.2.12 before a complete upgrade you can replace the modx.class.php from 2.2.13 via: https://raw.github.com/modxcms/revolution/v2.2.13-pl/core/model/modx/modx.class.php
  3. For releases between 2.2.6 and 2.2.11 inclusive, you can replace the modx.class.php with the one from the relevant 'pl2' tag in the MODX Revolution repository. E.g. for v2.2.10-pl it would be https://raw.github.com/modxcms/revolution/v2.2.10-pl2/core/model/modx/modx.class.php".
  4. For releases prior to 2.2.6, please contact MODX Support for assistance patching your version, or to get help with an upgrade to 2.2.13

Special Note for MODX Cloud Users
If your sites are on MODX Cloud, we've taken steps to protect all sites from this issue, as always we recommend you upgrade to 2.2.13 at your earliest convenience.

Acknowledgement
We would like to thank MODX community member, Mark Ernst, for bringing this issue to our attention.

Additional Information
For additional information, please use the MODX Contact Form]]>
https://forums.modx.com/thread/89486/modx-revolution-2-x-sql-injection#dis-post-492046 Fri, 07 Mar 2014 04:30:22 +0000 https://forums.modx.com/thread/89486/modx-revolution-2-x-sql-injection#dis-post-492046
<![CDATA[Security Bypass and Remote Execution]]> https://forums.modx.com/thread/84893/security-bypass-and-remote-execution#dis-post-468080 Product: MODX Revolution
Severity: Extremely Critical
Versions: 2.1.0–2.2.7
Vulnerability type: Security Bypass
Report date: 2013-Jun-4
Fixed date: 2013-Jun-4

Description
Two vulnerabilities were discovered in MODX that allow users to bypass security. Attackers could exploit this to remotely execute arbitrary code on the targeted server.

Affected Releases
All MODX Revolution releases from and including 2.1.0–2.2.7 are affected. Revolution 2.0.8 and below are not affected.

Solutions
There are two possible solutions:

  1. Upgrade to MODX Revolution 2.2.8, or
  2. Install this plugin patch until upgrade to 2.2.8+ is completed.

Acknowledgement
We would like to thank valued community members Fi1osof and Agel_Nash for bringing this issue to our attention.

Additional Information
For additional information, please use the MODX Contact Form]]>
https://forums.modx.com/thread/84893/security-bypass-and-remote-execution#dis-post-468080 Tue, 04 Jun 2013 09:55:36 +0000 https://forums.modx.com/thread/84893/security-bypass-and-remote-execution#dis-post-468080
<![CDATA[MODX Evolution 1.0.7 (and prior) ForgotManager plugin Vulnerability]]> https://forums.modx.com/thread/81545/modx-evolution-1-0-7-and-prior-forgotmanager-plugin-vulnerability#dis-post-449818 Product: MODX Evolution
Risk: Very High
Severity: Critical
Versions: 1.0.7
Vulnerabilty Type: Permissions, Privileges, and Access Control; Input Validation; SQL Injection
Report Date: 2013-Jan-4
Fixed Date: 2013-Jan-8

Description
The Forgot Manager Login plugin distributed with all versions of MODX Evolution (and 0.9.x) contains a vulnerability that allows users to gain unauthorized access to the MODX Manager.

Affected Releases
All MODX 0.9.x/Evolution releases prior to and including MODX Evolution 1.0.7 (with ForgotManager plugin active) are affected.

Solutions
There are three ways to resolve or mitigate the issue:

  1. Disable Forgot Manager Login plugin
  2. Upgrade Forgot Manager Login to version 1.1.6
  3. Upgrade to MODX Evolution 1.0.8.

NOTE
A special thanks to community member Jako for reporting this issue directly to MODX so a resolution could be made available before details were.]]>
https://forums.modx.com/thread/81545/modx-evolution-1-0-7-and-prior-forgotmanager-plugin-vulnerability#dis-post-449818 Tue, 08 Jan 2013 04:28:14 +0000 https://forums.modx.com/thread/81545/modx-evolution-1-0-7-and-prior-forgotmanager-plugin-vulnerability#dis-post-449818
<![CDATA[MODX Evolution 1.0.6 (and prior) Unauthorized Manager Access]]> https://forums.modx.com/thread/80701/modx-evolution-1-0-6-and-prior-unauthorized-manager-access#dis-post-444667 Product: MODX Evolution
Risk: Very High
Severity: Critical
Versions: 1.0.6 and all previous releases
Vulnerabilty Type: Permissions, Privileges, and Access Control; Input Validation; SQL Injection
Report Date: 2012-Nov-26
Fixed Date: 2012-Nov-26

Description
The Forgot Manager Login plugin distributed with all versions of MODX Evolution (and 0.9.x) contains a vulnerability that allows users to gain unauthorized access to the MODX Manager.

Affected Releases
All MODX 0.9.x/Evolution releases prior to and including MODX Evolution 1.0.6 are affected.

Solutions
There are three ways to resolve or mitigate the issue:

  1. Disable Forgot Manager Login plugin
  2. Upgrade Forgot Manager Login to version 1.1.4
  3. Upgrade to MODX Evolution 1.0.7.

NOTE
A special thanks to community member Agel_Nash for reporting the full scope of this issue directly to MODX so a resolution could be made available before details were.]]>
https://forums.modx.com/thread/80701/modx-evolution-1-0-6-and-prior-unauthorized-manager-access#dis-post-444667 Mon, 26 Nov 2012 03:33:34 +0000 https://forums.modx.com/thread/80701/modx-evolution-1-0-6-and-prior-unauthorized-manager-access#dis-post-444667
<![CDATA[MODX Website Compromise Update: Revolution Still Safe]]> https://forums.modx.com/thread/79153/modx-website-compromise-update-revolution-still-safe#dis-post-436674 MODX Revolution is Still Safe
After exhaustive investigation, at this point we have determined the recent modx.com security breach used custom code authored specifically for our website. It was not a result of code contained in any core releases of MODX Revolution. While we have taken additional steps to further secure our website, we will follow up with a more complete response in the coming weeks.]]>
https://forums.modx.com/thread/79153/modx-website-compromise-update-revolution-still-safe#dis-post-436674 Tue, 11 Sep 2012 11:10:08 +0000 https://forums.modx.com/thread/79153/modx-website-compromise-update-revolution-still-safe#dis-post-436674
<![CDATA[MODX Website Compromise]]> https://forums.modx.com/thread/79060/modx-website-compromise#dis-post-435698
Yes, one of the MODX web properties was not up to date and this was really not smart. We got burned, and this is our mea culpa. We have upgraded our websites to 2.2.4, changed all passwords related to our internal infrastructure, and set new policies going forward.

Your Passwords are Safe

No passwords or hashed passwords were disclosed. MODX does not store passwords on the affected websites by design (see Update 2 below), using a custom SSO application hosted on an external, secure server. Passwords are hashed and salted multiple times, with unique salts per user. Despite no access to passwords being disclosed, you may consider changing any non-unique passwords used across multiple websites.

We’re Sorry

We sincerely and profusely apologize for any inconvenience our lapse in diligence caused. We promise to do our utmost to be proactive going forward, taking every step we can to ensure we do not repeat this in the future.

Please Upgrade Your Sites

Security requires constantly staying on top of your websites; it’s an ongoing process and not a destination. As with any software, it’s important to to keep up to date when new updates come out. Upgrade your sites to the latest MODX versions when they’re released—no excuses.

Update 1: We clarified wording to accurately reflect that the actual passwords/hashed passwords were not disclosed.

Update 2: Further clarification that the user table field shared publicly by the culprit does not contain any passwords (we repurposed the field). It does contain:

  • Salts not used by our SSO
  • "cachepwd" (also not used by our SSO) which expires within minutes of creation.
]]>
https://forums.modx.com/thread/79060/modx-website-compromise#dis-post-435698 Mon, 03 Sep 2012 11:12:01 +0000 https://forums.modx.com/thread/79060/modx-website-compromise#dis-post-435698
<![CDATA[MODX Evolution 1.0.5 (and prior) Remote Script Execution Vulnerability]]> https://forums.modx.com/thread/74423/modx-evolution-1-0-5-and-prior-remote-script-execution-vulnerability#dis-post-412760 Product: MODX Evolution
Risk: Very High
Severity: Critical
Versions: 1.0.5 and all previous releases
Vunerability type: Remote Script Execution*
Report Date: 2012-Feb-16
Fixed Date: 2012-Feb-20

Description

A vigilant community member sent us a security notice to let us know that he found a security issue in a compromised site running MODX Evolution 1.0.5.

Upon investigation, we determined that MODX Evolution had been sanitizing global GPC (GET/POST/Cookie or Request) variables in a way that allowed any Snippet within MODX that echoed user input (i.e. a website form field) from the GPC variables back to the output (for display) to inadvertently execute the MODX tags provided in the input field.

*Remote script execution requires specific configurations of add-ons included in the core.

Affected Releases
All MODX 0.9.x/Evolution releases prior to and including MODX Evolution 1.0.5 are affected.

Solution
Upgrade to MODX Evolution 1.0.6]]>
https://forums.modx.com/thread/74423/modx-evolution-1-0-5-and-prior-remote-script-execution-vulnerability#dis-post-412760 Mon, 20 Feb 2012 04:44:07 +0000 https://forums.modx.com/thread/74423/modx-evolution-1-0-5-and-prior-remote-script-execution-vulnerability#dis-post-412760
<![CDATA[MODx Evo 1.0.4 (and prior) SQL Injection and Directory Traversal Vulnerabities]]> https://forums.modx.com/thread/268/modx-evo-1-0-4-and-prior-sql-injection-and-directory-traversal-vulnerabities#dis-post-1674 Status: Solved
Product: MODx Evolution
Severity: High
Versions: 1.0.4 and prior
Advisory Date: 2011-01-26
Fixed Date: 2011-01-19
Impact:
a) A remote attacker may access or view arbitrary files on the server.
b) A remote attacker may execute arbitrary PHP code as a result of SQL injection.

Description
JPCERT/CC has issued the following advisories:
a) http://jvn.jp/en/jp/JVN95385972/index.html
b) http://jvn.jp/en/jp/JVN54092716/index.html

Solution
Upgrade to MODx Revolution 1.0.5 available here: http://modxcms.com/download.html#ga
Read the Release Announcement for Evolution 1.0.5.
]]>
https://forums.modx.com/thread/268/modx-evo-1-0-4-and-prior-sql-injection-and-directory-traversal-vulnerabities#dis-post-1674 Fri, 28 Jan 2011 02:13:31 +0000 https://forums.modx.com/thread/268/modx-evo-1-0-4-and-prior-sql-injection-and-directory-traversal-vulnerabities#dis-post-1674
<![CDATA[Critical PHP Bug Security Notice and Patch]]> https://forums.modx.com/thread/267/critical-php-bug-security-notice-and-patch#dis-post-1673
More information can be found here:

This bug can affect MODx installations. MODx Revolution has been patched in GitHub for this. It is highly recommended that all MODx Revolution users patch their MODx installations with the fix made in this commit: https://github.com/modxcms/revolution/commit/3d8175c010374a3662fb86492fe7e808df0bae66 (do not copy the entire modx.class.php file, just the affected lines)

To patch for Revolution, simply paste the following lines into the file "core/model/modx/modx.class.php" after line 30 (after the comments):
if (strstr(str_replace('.','',serialize($_REQUEST)), '22250738585072011')) {
  header('Status: 422 Unprocessable Entity'); die();
}


Alternatively, if you don’t have FTP or SSH access to your server, you can download a Plugin-based patch via Package Management, in "Hotfixes & Security Updates" -> "Hotfix" -> "bug-3350". Installing it will patch your installation with a Plugin. (While the Plugin will work, MODX recommends patching the files if possible.)

To patch for Evolution, simply add the above lines at the top of the "manager/includes/protect.inc.php" file.

Since this is a PHP bug, and not a MODx bug, this will affect any and all MODx installations on server architecture that uses the x87 FPU and hasn’t forced SSE or float-store.

LATE UPDATE:

The MODX Team has released Revolution 2.0.6-pl2 which adds a workaround for this PHP bug, as well as a couple other issues. You can download it here: http://modxcms.com/download/. Upgrading is not required if you applied the patch above.

Changelog for 2.0.6-pl2:
MODx Revolution 2.0.6-pl2 (January 6, 2011)
====================================
- [#3350] Fix for PHP bug: http://bugs.php.net/bug.php?id=53632
- [#3347] Fix issue where renaming a file broke the browsing of directory tree
- Fix issue where FC tvDefault rules, regardless of active state, are always run
 
]]>
https://forums.modx.com/thread/267/critical-php-bug-security-notice-and-patch#dis-post-1673 Thu, 06 Jan 2011 09:43:30 +0000 https://forums.modx.com/thread/267/critical-php-bug-security-notice-and-patch#dis-post-1673
<![CDATA[Critical Security Upgrade Notice for FormIt, Quip and Login]]> https://forums.modx.com/thread/266/critical-security-upgrade-notice-for-formit-quip-and-login#dis-post-1672 FormIt, Quip and Login that could be used to expose system settings including database information.

This has been been corrected and new versions have been posted. Upgrading of FormIt, Login and Quip to the latest versions via Package Manager should be considered critical.

This only affects MODX Revolution installations that have installed the Extras FormIt, Quip and Login.

]]>
https://forums.modx.com/thread/266/critical-security-upgrade-notice-for-formit-quip-and-login#dis-post-1672 Thu, 09 Dec 2010 08:17:16 +0000 https://forums.modx.com/thread/266/critical-security-upgrade-notice-for-formit-quip-and-login#dis-post-1672
<![CDATA[phpThumb Command-Injection Vulnerability]]> https://forums.modx.com/thread/265/phpthumb-command-injection-vulnerability#dis-post-1671
The application is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input to the ’fltr[]’ parameter in the ’phpThumb.php’ script.

Attackers can exploit this issue to execute arbitrary commands in the context of the webserver.

Note that successful exploitation requires ’ImageMagick’ to be installed.

phpThumb() 1.7.9 is affected; other versions may also be vulnerable.

If you are using phpThumb on any of your sites either as part of a plugin or standalone, you should use the following fix to secure your site:
http://modxcms.com/forums/index.php/topic,54874.msg316279.html#msg316279

Note: This vulnerability does not affect the phpThumb that is included in the MODx Revolution distribution.
]]>
https://forums.modx.com/thread/265/phpthumb-command-injection-vulnerability#dis-post-1671 Tue, 05 Oct 2010 11:01:07 +0000 https://forums.modx.com/thread/265/phpthumb-command-injection-vulnerability#dis-post-1671
<![CDATA[MODx Revolution 2.0.3 Addresses Pair of Vulnerabilities]]> https://forums.modx.com/thread/264/modx-revolution-2-0-3-addresses-pair-of-vulnerabilities#dis-post-1670 reported security vulnerabilities with MODx Revolution 2.0.2-pl and possibly earlier releases:

Input passed via the "modhash" parameter to manager/index.php is not properly sanitized before being returned to the user and input passed via the "class_key" parameter to manager/controllers/default/resource/tvs.php is not properly verified before being used to include files.

We recommend that anyone running previous versions of MODx Revolution upgrade to 2.0.3.

Download MODx Revolution 2.0.3-pl: http://modxcms.com/download/#pl

Details of other improvements introduced in the 2.0.3 release can be found here: http://modxcms.com/forums/index.php/topic,55104.0.html]]>
https://forums.modx.com/thread/264/modx-revolution-2-0-3-addresses-pair-of-vulnerabilities#dis-post-1670 Thu, 30 Sep 2010 01:47:17 +0000 https://forums.modx.com/thread/264/modx-revolution-2-0-3-addresses-pair-of-vulnerabilities#dis-post-1670