Support

Admin Tools

#24309 Strange Security Exception e-mail content

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by on Saturday, 27 February 2016 17:20 CST

Thursday, 28 January 2016 06:03 CST

raffaEl
 I've received Security Exception email with that content:

Hello,
We would like to notify you that a security exception was detected on your site, rendergarden.org | wizualizacje 3D - portfolio i blog, with the following details:

(I can't paste it here because your 403 protection page appears, so I'm attaching it to Message.)

If this kind of security exception repeats itself, please log in to your site's back-end and add this IP address to your Admin Tools's Web Application Firewall feature in order to completely block the misbehaving user.

So, instead IP info there is probably fragment of code which was tried to execute.

All Best,
kcpr

Thursday, 28 January 2016 07:11 CST

nicholas
Not strange at all. Admin Tools protects you from the following issues:
https://www.joomla.org/announcements/release-news/5641-joomla-3-4-6-released.html
https://www.joomla.org/announcements/release-news/5643-joomla-3-4-7.html
The attack vector is either the user agent string OR the X-Forwarded-For HTTP header. The latter tells the server to set the IP address of the remote visitor to the contents of the X-Forwarded-For HTTP header. Since the content is malicious Admin Tools blocks it. In order to see the correct IP address please go to Components, Admin tools, Web Application Firewall, Configure WAF and set the "Enable IP Workarounds" option to No. As the documentation tells you, you should not enable this option unless your site is behind a reverse proxy or a CDN.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Saturday, 27 February 2016 17:20 CST

System Task
system
This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.
Edited by on 2016-02-27 17:20 CST

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!