GoDaddy mod_security

Started by Krashsite, May 31, 2016, 04:25:17 PM

Previous topic - Next topic

Sir Osis of Liver

Did anyone ever come up with a fix for this?

Fatal error: require_once() [function.require]: Failed opening required '/home/content/43/12872143/html/forum/Sources/Subs-Auth.php' (include_path='.:/usr/local/php5_3/lib/php') in /home/content/43/12872143/html/forum/Sources/Security.php on line 543

Has it been addressed in 2.1?
Ashes and diamonds, foe and friend,
 we were all equal in the end.

                                     - R. Waters

Arantor

How can we resolve "the host removed the file because it tripped a really obscure, hard to diagnose security scan where it uses a function that malicious people use therefore it must be bad" problem?

Sir Osis of Liver

Wonder what they're scanning for.  File uploads, shows up for a fraction of a second, then disappears.  Forum owner will ask GD to disable it, don't know if they will.
Ashes and diamonds, foe and friend,
 we were all equal in the end.

                                     - R. Waters

Illori

if you upload the file with the file manager it will not disappear. we have tried to find out why files go missing but they dont tell us why.

Sir Osis of Liver

It's being triggered by this -



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['search']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['search']));



Ashes and diamonds, foe and friend,
 we were all equal in the end.

                                     - R. Waters

Sir Osis of Liver

Quote from: Illori on May 31, 2016, 05:03:44 PM
if you upload the file with the file manager it will not disappear.

That works, thanks.  Forum is running.  Must be something specific to ftp server.
Ashes and diamonds, foe and friend,
 we were all equal in the end.

                                     - R. Waters

Sir Osis of Liver

If you change this -



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['search']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['search']));



to this -



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['']));



Subs-Auth.php uploads normally.  If you put anything in the brackets in $_REQUEST[''] -



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['test']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['test']));



it fails.

The third line in that code block -



$_REQUEST['search'] = strtr($_REQUEST['search'], array('%' => '\%', '_' => '\_', '*' => '%', '?' => '_', '&' => '&'));



does not trigger the problem.

Ashes and diamonds, foe and friend,
 we were all equal in the end.

                                     - R. Waters

Arantor


nend

I haven't notice this issue, using SSH.

vbgamer45

Quote from: Sir Osis of Liver on June 01, 2016, 12:58:36 PM
If you change this -



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['search']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['search']));



to this -



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['']));



Subs-Auth.php uploads normally.  If you put anything in the brackets in $_REQUEST[''] -



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['test']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['test']));



it fails.

The third line in that code block -



$_REQUEST['search'] = strtr($_REQUEST['search'], array('%' => '\%', '_' => '\_', '*' => '%', '?' => '_', '&' => '&'));



does not trigger the problem.



I ended up running into this I changed the code to make it more hidden

eval(base64_decode('JF9SRVFVRVNUWydzZWFyY2gnXSA9ICRzbWNGdW5jWydodG1sc3BlY2lhbGNoYXJzJ10oJF9SRVFVRVNUWydzZWFyY2gnXSkgLiAnKic7CgkkX1JFUVVFU1RbJ3NlYXJjaCddID0gdHJpbSgkc21jRnVuY1snc3RydG9sb3dlciddKCRfUkVRVUVTVFsnc2VhcmNoJ10pKTs='));

Community Suite for SMF - Take your forum to the next level built for SMF, Gallery,Store,Classifieds,Downloads,more!

SMFHacks.com -  Paid Modifications for SMF

Mods:
EzPortal - Portal System for SMF
SMF Gallery Pro
SMF Store SMF Classifieds Ad Seller Pro

Arantor

Suspect that will get flagged for looking like malware.

vbgamer45

I did it for one file. Then realized godaddy flagged also
Post.php
PersonalMessage.php
Subs-Auth.php
ModerationCenter.ph
Subs-Post.php
LogInOut.php
Subs-Editor.php
Register.php
Reminder.php

Then wrote a script to upload the file and that works. Seems like they just delete/scan the files on ftp upload..
Community Suite for SMF - Take your forum to the next level built for SMF, Gallery,Store,Classifieds,Downloads,more!

SMFHacks.com -  Paid Modifications for SMF

Mods:
EzPortal - Portal System for SMF
SMF Gallery Pro
SMF Store SMF Classifieds Ad Seller Pro

Aleksi "Lex" Kilpinen

Yup, we've seen that alot. And always without exception the solution has been to upload the missing files using another method. Sucks, but that's how it is.
Slava
Ukraini!
"Before you allow people access to your forum, especially in an administrative position, you must be aware that that person can seriously damage your forum. Therefore, you should only allow people that you trust, implicitly, to have such access." -Douglas

How you can help SMF

Sir Osis of Liver

Most files I've ever seen blocked was an even dozen, but hasn't happened recently.  GoDaddy has so many different server configurations, you never know what you're working with (neither do they).
Ashes and diamonds, foe and friend,
 we were all equal in the end.

                                     - R. Waters

Advertisement: