Security issues with MODx Evolution 0.9.6.3 and 1.0.0?

Not in the next release, but it’s definitely going to be in a future release.

Quote from: rthrash at Sep 08, 2009, 10:59 PM

--- manager/index.php	2009-09-08 12:33:54.000000000 +0200
+++ manager/index.php	2009-09-08 12:35:35.000000000 +0200
@@ -230,7 +230,7 @@ if (isset($modx->config['validate_refere
         $referer = $_SERVER['HTTP_REFERER'];
 
         if (!empty($referer)) {
-            if (!preg_match('/'.preg_quote(MODX_SITE_URL, '/').'/i', $referer)) {
+            if (!preg_match('/^'.preg_quote(MODX_SITE_URL, '/').'/i', $referer)) {
                 echo "A possible CSRF attempt was detected from referer: {$referer}.";
                 exit();
             }

I’m unsure of how, exactly, I should make the edit to index.php.

Thanks.

The diff is one character: ^

Just add this to the preg_match expression in the line that changed (the one with the + sign in the diff) so that it looks like this:

Hi,

My code is not the same as in the fix.



This line: if (!eregi(MODX_SITE_URL, $referer)) {

@Colin: Make sure you have upgraded to Evo 1.0 before applying the patch, I suspect you are running an older version of MODx.

Hi Garry,

Ryan’s post was not clear that this was meant only for Evo 1.0, and mentions 0.9.6.3 specifically in the previous paragraph.

I am running 0.9.6.3. Should this be patched, and if so, how? Having looked again at the blog by Heine, I see that s/he only mentions Evo 1.0 for the fix. I should have read it more carefully.

Additionally, I’m unsure of how to make the edit to document.parser.class.php that Ryan suggests.

Thanks.

Ok, from now on...

For manager users:
Firefox addon:
https://addons.mozilla.org/en-US/firefox/addon/8996
//if I can ask them to use SSL why not to use this!

For privileged web users:
PHP class:
http://www.phpclasses.org/ --> Class: CSRF protector

Quote from: mrhaw at Sep 09, 2009, 08:44 PM

Ok, from now on...

For manager users:
Firefox addon:
https://addons.mozilla.org/en-US/firefox/addon/8996
//if I can ask them to use SSL why not to use this!

Only works with Firefox: 3.0 – 3.0.*, not the latest version

I don’t think it’s reasonable to require your clients or users to use a particular browser and install certain addons or such to use a website. I believe it makes more sense to fix the problem internally.

Quote from: einsteinsboi at Sep 09, 2009, 09:49 PM

...

Only works with Firefox: 3.0 – 3.0.*, not the latest version

I don’t think it’s reasonable to require your clients or users to use a particular browser and install certain addons or such to use a website. I believe it makes more sense to fix the problem internally.

Not "require them" but to "present them with" a safer option.

The reason of using e.g. SSL is it makes things way safer - not 100% safe.
If MODx REQUIRED you to use SSL to login it would totally suck!

This CSRF risk can be dealt with right away by recommending the client to use a Firefox plugin when logged into the manager
or dedicate a browser alone for MODx and trusted pages. Banks very often require you to use one choosen browser for certificates and logins.
If MODx REQUIRED you to re-type your password on every action it would prevent the risk BUT it would totally suck.

//I don’t want to re-type my password all the time when I’m logged in as root in vista or ubuntu...

Nice token examples btw --> http://shiflett.org/articles/cross-site-request-forgeries
and #8 http://www.phpfreaks.com/tutorial/php-security

An idea for a quick fix (well quicker at least than implementing token checks for every Manager form/action) - IF there was a Manager Access Event equivalent to the existing front-end event ’OnWebPagePrerender’ - let’s call it ’OnManagerPagePrerender’ - you could use regular expressions to parse the output and append a token string to any existing links or form actions in the rendered Manager page, and then add token initialisation and checking globally to the Manager page header include. Would it be hard to create such an event?