Cross site scripting detection / logging - alteration of modx document.parser.

Hi there,

After we put our site live and started posting new work etc. The system event log started showing quite a few parse errors. Upon closer inspection it seems that the error was this

« MODx Parse Error »
MODx encountered the following error while attempting to parse the requested resource:
« ID passed in request is NaN! »

Parser timing
MySQL: [^qt^] ([^q^] Requests)
PHP: [^p^]
Total: [^t^]

Outside of thinking that this was a scanner or zombie net looking for erronous id’s I didn’t think too much of it. I thought it may have been some bad urls being passed to our RSS feeds which I was working on but after resolving that we were still getting these errors. Sometimes thick and fast.

I thought, ok, this isn’t hammering the bandwidth but let me see if it’s a single ip address or a visitor wide problem.

To get a better idea I dug out some ip fetching code from here and added a new field into the system event MySQL table to allow recording the ip address and appending the id being looked for onto the end of the error message.

To do this I altered document.parser.class.inc.php to execute a get ip address feature into the logEvent function. Seems to work well enough.


What I discovered after running this for a couple of days alarmed me a little but at the same time re-assured me that ModX was solid enough to handle some of these more deviant attacks on our site.

now our logs record this:

« MODx Parse Error »
MODx encountered the following error while attempting to parse the requested resource:
« ID passed in request is NaN! »

Parser timing
MySQL: [^qt^] ([^q^] Requests)
PHP: [^p^]
Total: [^t^]

ip_address:193.192.70.xxx - id: http://amyru.18.ru/images/cs.txt?

DON’T TYPE THE ABOVE URL INTO A BROWSER IT’S A FAKE DOMAIN NAME & IP ADDRESS.
(xxx replacing the last 3 digits.) -

Some of these have recorded text files which contain some very elaborate php attempting to be executed on our servers.

I can post what I changed in the document.parser code to help anyone else who is experiencing a long list of parse errors in their event logs.
I was considering a way to compiling this set of ip addresses and using a re-direct to else where, but I’m not too familiar with pre-render page event scripts running.

Anyone got any tips as to how I should approach this?

I’ve been thinking a lot about a blacklist table and plugin that could be used in a MODx site to prevent various forms of attack and abuse. Something like the SpamKarma plugin for WordPress, but not specific to comment POSTing; i.e. a mini traffic analysis plugin that auto-bans IPs or notifies the admin of questionable hits. Could even have it load a queue that could be reviewed, like a moderation list for site visitors: hey this guy did this and this which was questionable; you can ban the user IP or let him continue without future warnings by whitelisting him or adjusting some analysis options.

Anyway, I think this would be a great candidate for an official MODx Extension project and would love to work on a proposal for such with you and anyone else in the community that is interested in contributing to the effort.

In the meantime, you should be able to create a plugin and for instance, capture any NaN error and do a simple $modx->sendUnauthorizedPage() or $modx->sendErrorPage(), or even just an exit() to terminate the request completely without any further resources wasted.

That does indeed sound like a great feature. I may just get involved with that. Let me know if you want any testing/feedback on such things. For now I’ll try writing a plugin and see what results I can yield with the tips above.

If anything I’ll try and make a lite ip recorder and checker and see if it’ll bog entry onto the site down etc. then maybe move to parsing that into some sort of (maybe even server side firewall wise) ip restriction either within or outwith modx.

As it stands, thankfully ModX is standing up ok to these erroneous attempts. As our site gets more popular there’s more people having a play with it. In both ways, as a visitor and as a target.