Admin Tools

#24071 IP address field contains code in WAF alert

Posted in ‘Admin Tools for Joomla! 4 & 5’

This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version

n/a

PHP version

n/a

Admin Tools version

n/a

Latest post by on Wednesday, 03 February 2016 17:20 CST

Monday, 04 January 2016 04:46 CST

mavdo

The WAF blocker has recently started picking up MUA Shield events, which it has not done in the past 3 years, but some are now coming up with crazy IP addresses which means it is impossible to blacklist these events. Eg:

<Unfortunately I can only manage to attach the example as a picture. Attaching as text into the ticket triggers your own site protection>

How can I blacklist these events and is this a new type of attack that needs an upgrade of AdminTools?

Cheers

Monday, 04 January 2016 05:03 CST

tampe125

Hello Alan,

previous versions of Joomla were vulnerable to code injected inside the User-Agent or the IP address, that's why there are these new kind of attacks.
Sadly you are right: you can not blacklist them, since the IP address is corrupted. However you don't have to worry about it: the attack was blocked and it wasn't able to compromise your site.

Davide Tampellini

Developer and Support Staff

🇮🇹Italian: native 🇬🇧English: good • 🕐 My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Wednesday, 03 February 2016 17:20 CST

System Task

system

This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.

Edited by on 2016-02-03 17:20 CST

Support