mcsmom wrote:
You should disable it.
THAT IS THE WORSE EVER ADVICE I HAVE EVER READ ON THESE FORUMS!! Furthermore, not every Joomla user has root access to turn off mod_security or modify its rules.
While I appreciate that not every server will have mod_security installed, the latest rules that I would recommend (from gotroot.com) are quoted below and ensure all most active attacks against a site using xmlrpc are filtered.
Code:
#MTS
#XML-RPC generic attack sigs
SecRule REQUEST_HEADERS "^Content-Type\: application/xml" chain
SecRule REQUEST_BODY "(\<xml|\<.*xml)" chain
SecRule REQUEST_BODY "(echo( |\(|\').*\;|chr|fwrite|fopen|system|echr|passthru|popen|proc_open|shell_exec|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo)\(.*\)\;" chain
SecRule REQUEST_BODY "methodCall\>"
#Specific XML-RPC attacks on xmlrpc.php
SecRule REQUEST_URI "(xmlrpc|xmlrpc.*)\.php" chain
SecRule REQUEST_BODY "(\<xml|\<.*xml)" chain
SecRule REQUEST_BODY "(echo( |\(|\').*\;|chr|fwrite|fopen|system|echr|passthru|popen|proc_open|shell_exec|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo)\(.*\)\;"
#Too generic, unless you know you won't see this in any of the fields of an XMLRPC message on your system
#SecRule REQUEST_URI "/xmlrpc\.php" chain
#SecRule "(cd|perl |python |rpm |yum |apt-get |emerge |lynx |links |mkdir |elinks |cmd|pwd|wget |id|uname |cvs |svn |(s|r)(cp|sh) |rexec |smbclient |t?ftp |ncftp |curl |telnet |gcc |cc |g\+\+ |\./)"
#XML-RPC SQL injection generic signature
SecRule REQUEST_URI "(xmlrpc|xmlrpc_.*)\.php" chain
SecRule REQUEST_BODY "<methodName>.*</methodName>.*<value><string>.*(select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |,]+[[:space:]](from|into|table|database|index|view).*methodName\>"
Quote:
You need to edit myrules.conf inside /usr/local/apache/conf/js_modsecurity/
Not always the correct path - on cpanel boxes its different and depends on apache/mod_security version:
/etc/httpd/conf/modsec2.user.conf
/etc/httpd/conf/modsec.user.conf
I would recommend that you change (If you can - or suggest this forum post to your web hosting company) your single line
Quote:
SecRule REQUEST_URI|REQUEST_BODY "xmlrpc"
With the rules quoted above - this will filter all most "seen" exploits in real life and also allow Joomla 1.5 to save (Actually it falls over on the REQUEST_BODY part)
AND IF YOU CANNOT GET YOUR mod_security settings changed:
Then you will need to rename every instance of xmlrpc_server in the Joomla 1.5 code - very easy to do with a PHP editor like Zend or Eclipse - just search and replace with something like "xserver" -
there are only 22 occurrences in 12 files for the word: xmlrpc_serverI hope this is a more helpful post :-)
_________________
Phil Taylor - Full Time Joomla/PHP Expert
Blue Flame IT Ltd. --
http://fix.myjoomla.com/ Same day commercial fixes for Joomla sites worldwide
--
http://www.phil-taylor.com/
