ModX Security

I haven’t been around the forums for some time now so I thought I’d check in on MODX security. I’ve installed MODX on many websites and over the past year I’ve had tons of security problems. Don’t get me wrong, I think it’s the best CMS out there, but have others had this problem or have there been a lot of security fixes that I’ve missed?

My host has requested that I remove modx or he will not unsuspend my accounts. Thousands of emails are being sent through my modx installation per day that I have no control of.

I’m not an internet security expert (as you can probably tell from this post), but does anyone have any advice? Were there issues with some of the past contact forms?

First you might want to start with more information about your installs (server and modx specs), and what snippets you’re running. If you’re still running 0.9.2.1 or have a host that has register_globals set to on, this was a known issue last year which was resolved within hours of being identified (see the Security topic sticky posts).

Yes, it is an older instance of Modx and register globals is on. I’ll make sure to upgrade all my sites as I should have a while ago.

Again, thanks for all the time you guys put into modx. You really do a great job.

Also make sure that you set register_globals to OFF. This is by far the one thing that makes the biggest difference in the security of any PHP script. I doubt that there is code in MODx 0.9.5+ that is vulnerable to this type of attack, but packages like TinyMCE and the Resource Browser (as well as third-party snippets) are not coded by the MODx team, and hackers usually look for scripts like that which are distributed widely and integrated into many other contexts.

Even though it is written by ModX team, security flaws is often not noticed until someone break in. Then you also have to find the flaw.
I never believe in the "perfect aplication" until ive seen it in action for a long time. Ive seen very few reports on this, but still, modx i quite new compared to others.

Glad we got to the root of the problem quickly, too!

Quote from: beryl at Apr 03, 2007, 10:48 AM

Even though it is written by ModX team, security flaws is often not noticed until someone break in. Then you also have to find the flaw.
I never believe in the "perfect aplication" until ive seen it in action for a long time. Ive seen very few reports on this, but still, modx i quite new compared to others.

That’s certainly true. I’m not arguing that the MODx team is perfect or that a flaw or bug might not exist in 0.9.5+. In fact, if I had to place a bet on whether some type of vulnerability were present in any software I’d always bet yes.

But this specific vulnerabilty is caused by coding like it’s 1999. Back then many programmers took advantage of the fact that by default PHP registered variables globally (meaning made variables passed via GET and POST and COOKIE and SESSION outside those specific arrays and on a global scope). It seemed to make coding so much easier, and even shopping cart programs and other systems that theoretically placed a high premium on security used this technique as if there were no problem.

Of course it turns out that this was a HUGE security hole, and it has been exploited relentlessly over the last few years. Because MODx was based on Etomite (which was written back in the days when register_globals was not a big concern), versions prior to 0.9.5 had a lot of legacy code that needed to be rewritten. But given all the effort that went into the task of updating everything for 0.9.5 and the fact that it has been thoroughly tested with register_globals OFF (which would cause any code that assumes it will be ON to fail), it’s a much safer bet that this particular vulnerabilty no longer exists in MODx.

I know ivé read that the development team of PHP was going to remove this in future versions.
Seems like a gooda ideá i think, that way developers still using this are forced to update their code.

PHP 6 will remove register_globals entirely indeed.

I shure look forward to PHP 6, such nice language, and still getting alot better.
This should sum it up:
"PHP6 is taking an interesting move in my mind - it’s as if the PHP developers want to now educate developers about the right way to code something, and remove those lingering issues with "Well you SHOULD be doing it this way, but you can still do it the old way". This will not be the case any longer. Removing totally the likes of register globals, magic quotes, long arrays, {} string indexes and call-time-pass-by-references will force developers to clean up their code."
"Richard Davey"