Security issues with MODx Evolution 0.9.6.3 and 1.0.0?

http://modxcms.com/forums/index.php?topic=29067.0
http://modxcms.com/forums/index.php?topic=36771.0
http://translate.google.com/translate?hl=en&sl=ja&tl=en&u=http://modxcms.com/forums/index.php%3Ftopic%3D28912.15;

secunia.com: 7 for MODx, 216 for Drupal, 139 for Joomla, 125 for Wordpress

http://www.gnucitizen.org/blog/preventing-csrf/

http://translate.google.com/translate?hl=en&sl=ja&tl=en&u=http://modxcms.com/forums/index.php%3Ftopic%3D28912.15;

:) mrhaw: are you reading the japanese MODx-forums? wow, you’re truly a MODx-warrior

Heine raises very valid points, and I personally appreciate them very much. He’s not attacking or tying to make MODx look bad in any way. It’s easy to get defensive and dismissive, but the fact it it only takes one successful exploit and it doesn’t matter if you’ve got 1 report or 1,000,000. Thanks Heine, and any further advice or findings will be likewise welcomed.

Just to reiterate, you should take the following actions:

1) Turn on referrer checks
2) Apply the patch as outlined above to make sure the referrers are in fact originating from the MODx site

(Both of these will be done in the next release.)

I agree with you Ryan! Thank you for your clear replies.
Sorry to the drupalist!

@sharkbait I love all the forums! I’m a geeeeek.

Quote from: rthrash at Sep 09, 2009, 12:07 AM

We’ll figure out a spot for important announcements on the main home page in the near future.

Brilliant! It took Mary’s charm for this to be effected Joking aside, thx for all your efforts.

cheers/k

With MM one can create a custom tab next to the security tab inside MODx manager, for importing the security RSS feed from
one’s host as well. That is by far the best way of being updated IMO.

I admit at first I was like oh man. But then I started to think to be honest - no matter what CMS one uses there is usually always going to be a security hole and it takes time to find them and resolve them. Every system - MAC, Windows, Linux they all have security holes and if you’re not careful you will get exploited. But we still buy them and utilize them at our own risk. Granted I do agree in some extent that some security issues might need to be accessible somewhere where we can find them. But lately I have friends who have been kinda freaking out because their Wordpress sites are getting hacked. And in the past, I dont really remember WP getting hacked much but mostly Joomla - and now when Im reading with some folks who are freakign out that WP is getting hacked unless you move to the latest version which is 2.8.4. But then again - this was good that you brought this out in the open Mary, but again - we will always find holes in one way or another. Thanks for posting a fix for this MODx -

Looking forward to more and even better Modx builds!

Quote from: Billy_Koch at Sep 09, 2009, 11:06 AM

But then again - this was good that you brought this out in the open Mary, but again - we will always find holes in one way or another.

I think my biggest concern, in retrospect, is not so much that there’s a (potential or real) security issue, it’s more the accessibility of this information and its fix to the community. I was perturbed that I read about it first from an outside source who clearly stated he had already discussed this with the MODx devs, and there wasn’t a cohesive and detailed source of information that I could find on the MODx website on this issue or on how to fix it. Hence my suggestions in my posts above that Ryan has said he will address.

The discussion happened literally hours before the post, FYI, in the IRC channel.

Will a future security patch implement user-specific tokens for $_POST and $_GET requests? As Heine has pointed out the referrer can easily be spoofed.