Admin Tools

#19709 The dreaded DFI Shield and JCE

Posted in ‘Admin Tools for Joomla! 4 & 5’

This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version

n/a

PHP version

n/a

Admin Tools version

n/a

Latest post by tampe125 on Friday, 28 March 2014 08:08 CDT

Friday, 28 March 2014 02:14 CDT

Adam_NZ

Hi Nicholas,

On one particular site, I keep getting dozens of DFI-Shield related errors. This site has JCE enabled (arrrgh!) and I was going to add an exception to WAF for it.

However - looking at the log, it doesn't look like the IP addresses correspond to any known admins that could be using JCE. They're using the Image Manager, and the entry always has the same cid:

?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&method=form&cid=20&6bc427c8a7981f4fe1f5ac65c1246b5f=cf6dd3cf1923c950586d0dd595c8e20b

I've heard JCE loopholes are used by many hackers, so I'm wondering if allowing JCE to have an exception is therefore a bad idea.

As ever, keep up the good work!

Adam.

Friday, 28 March 2014 03:10 CDT

tampe125

Hello Adam,

if JCE is updated to the latest version, you are running no risks.
The attackers are trying to exploit a vulnerability, but it has been patched in latest JCE versions.

However, Admin Tools is blocking that request and bans the ip.
So, in my opinion, you should not add an exception for it and simply ignore these logs: they simply are blocked attacks.

Davide Tampellini

Developer and Support Staff

🇮🇹Italian: native 🇬🇧English: good • 🕐 My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Friday, 28 March 2014 06:46 CDT

Adam_NZ

Hi Davide,

Thanks for the knowledgeable (and useful) reply. As with AdminTools and Akeeba Backup, I've always made sure my JCE is always up-to-date.

I'll remember to NOT add JCE to the exceptions (I don't have any others in there).

Adam.

Friday, 28 March 2014 08:08 CDT