Other Security Issues.

Hi All,

Thanks for the updates on the security loop holes in MODx and thanks for the great work that you have been doing thus far.

I’ve been looking though some of the code and I think I might have found another place where Remote inclusion might be possible:

AjaxSearch snippet - line 27:

include_once $base_path . ’assets/snippets/AjaxSearch/AjaxSearch.inc.php’;

If the install folder was not remove then this might be a possible hole as well:
/install/instprocessor.php - line 96:

include "$setupPath/sqlParser.class.php";

It might be best to scan all modx snippets, plugins, modules for such vulnerabilities.

Thanks for reporting those Raymond. How do you suggest we fix the ajax search since it’s used on the front end?

I found a couple of more vulnerable spots and I have addressed them all in SVN (revision 1922) by adding constants to represent the base_path. Constants cannot be set via request parameters with register globals on, and this is also the approach being used in the new core, so I went ahead and introduced these new constants now, and used it to fix all the potential remote file inclusion vulnerabilities we’ve found.

These new constants are simply...

MODX_BASE_PATH -> $base_path
MODX_BASE_URL -> $base_url
MODX_SITE_URL -> $site_url

By using these constants rather than the equivalent global variables, we can ensure that direct script access can never result in a successful remote file inclusion.

Please note, you must run the upgrade script to get the new constants in your config file.

FYI team, to address the identified, as well as some other potential remote file inclusion attack vectors identified here, and via other sources, a little more thoroughly and immediately for 0.9.2.1 installations, I have ported these or similar changes back to the 0.9.2.1 release (which is confusingly located in SVN under tattoo/releases/MODx-0.9.1; my bad and I’ll straighten out the tags on the appropriate revisions when I get a chance), and packaged them up as MODx 0.9.2.2. The security patch release packages, as well as a patch distributions of changed files for existing 0.9.2.1 installations, are now available from the download page.

Great work !

This will prove (if needed) that reaction time about security issues is lightning fast and quickly solved.

Good going Jason. Constants are the way to go.