Answered 404 page not working when an encoded forward slash is in the URL (%2f)

Hello all. I am new to ModX. Currently using MODX Revolution 2.2.14-pl.


My company have had a security audit, which states we have a content injection issue with our website. This is quite a loose definition of content injection, but it must be fixed nonetheless.

Our website has a 404 page configured for use in the general site settings. That works fine in almost all cases.

If the url contains an encoded slash "%2f", the usual 404 page is not displayed, and instead a generic 404 page is shown which will include any text in the url given, which can potentially ask the person browsing to go to a different site. Please see the attached file for an example of the "content injection".

You'd have to be a complete idiot to fall for something like that, but I have no choice but to be compliant with this security audit.

What can I do to force the usual 404 page in this case?

Many thanks in advance. [ed. note: jzsjzs last edited this post 9 years, 11 months ago.]

Before messing with the 404 page, you need to find and fix whatever is injecting the malicious content. That might make the encoded slash go away.

Quote from: BobRay at Nov 15, 2016, 11:31 PM

Before messing with the 404 page, you need to find and fix whatever is injecting the malicious content. That might make the encoded slash go away.

That is not possible, we can never stop somebody sending a fake link such as www.company.com/%2f%20this%20page%20has%20been%20moved%20to%20www.securityrisk.com and posing as an employee from our company.

The issue is not that somebody is actively doing that right now, it is a hypothetical risk which I have no choice but to proactively prevent and be compliant with the security audit I mentioned.

Any suggestions are appreciated.

Sorry, I misunderstood your issue.

How about a rewrite rule at the top of the .htaccess file that redirects any URL that contains .com twice, or contains .com not preceded by your domain name, to a black hole?

BTW, you should definitely upgrade. There are a number of much more serious security issues that have been fixed in later versions of MODX. In addition, some of the 2.2.x versions suffer from cache corruption. The current version is 2.5.2, so you're pretty far out of date. Be sure to upgrade to 2.3.0, 2.4.0 and 2.5.0 when you update the site -- some database structure changes occurred in those versions. [ed. note: BobRay last edited this post 9 years, 11 months ago.]

Quote from: BobRay at Nov 16, 2016, 04:15 PM

Sorry, I misunderstood your issue.

How about a rewrite rule at the top of the .htaccess file that redirects any URL that contains .com twice, or contains .com not preceded by your domain name, to a black hole?

Thanks for your suggestion Bob, I think the security test could probably be thwarted by a rewrite rule as you say.

Out of curiosity, do you have any ideas on why the "%2f" slash is causing the generic apache 404 page instead of the one we have configured?

That's a really good question. I'm afraid I can't think of any reason for it.

Also out of curiosity, does the site have a 404.shtml page?

Quote from: BobRay at Nov 19, 2016, 12:05 AM

Also out of curiosity, does the site have a 404.shtml page?

I don't believe so. Our 404 page has a content type of HTML - is there an easy way to change this and test? I can't see SHTML in the list.

Thanks

I'm glad you got it sorted. Sorry I didn't think of that.

Thanks for reporting back.