Main navigation
Product navigation
Main content

The forum operates in read-only mode. Please head to StackOverflow for support.

Last post

Tue, 08/14/2007 - 02:54

#1

ashler

Joined: 14/08/2007

Posts: 6

Am I being hacked??

Firstly, I am new to fckEditor. Secondly, I am reasonably new to web development. Thirdly, I have spent ages scouring this forum and the web looking for a concrete answer to what I am about to ask, and although some sites or posts seem to point to an answer I am still confused.

I am running fckEditor on an asp page that writes a feedback form to an access mdb. I recently found a whole bunch of records in my mdb that look something like the following:

At last...
<a href= ></a> *

Now, I am pretty sure I am the victim of a vulnerability exploitation, and I have looked at my fckEditor setup but can't find any sign of actual malicious damage. Can someone please explain to me what these guys are doing, how I can check if they have been successful, and how can I ensure they don't do it in the future? I am using the newest fckEditor release, my filemanager is disabled, and the fckEditor tree is in my web root (which I now understand could be a problem from what I have read on here).

This really has got me baffled, so a detailed explanation would be appreciated. I apologise for having to ask and not being able to figure this out from previous posts, and maybe it is the late hour, but I am just unsure of what is actually happening here.

Ash.

Tue, 08/14/2007 - 03:10

#2

n00b32

Joined: 14/08/2007

Posts: 23

Re: Am I being hacked??

ummm you say you have the config ok..

but could you tell me what you do AFTER you get the output of fckeditor i mean do you do like pasteintodb($_GET['fckeditor']);

i hope you understand me im writing umm a bit nonsense cause its 3:15 in poland and i havent slept over 24 hours

Tue, 08/14/2007 - 03:14

#3

ashler

Joined: 14/08/2007

Posts: 6

Re: Am I being hacked??

I am taking the output from the fcked object, testing it for SQL injection, then using it in a constructed SQL insert statement that writes it to the mdb along with a few text and id fields.

Using the execute method of a connection object for the insert, if that helps.

Ash.

Tue, 08/14/2007 - 03:18

#4

n00b32

Joined: 14/08/2007

Posts: 23

Re: Am I being hacked??

um ok.. so there is no sql injection ?

then what seems to be the problem cause i dont get it ? xDDD

Tue, 08/14/2007 - 03:20

#5

n00b32

Joined: 14/08/2007

Posts: 23

Re: Am I being hacked??

can you show me what code you use for the anti-sql inject??

Tue, 08/14/2007 - 03:28

#6

ashler

Joined: 14/08/2007

Posts: 6

Re: Am I being hacked??

The SQL injection test is a basic one just using a replace function to capture single quotes. On submit, the asp captures the form values and does:

Message = Replace(request("fckEditor1"),"'","''")

Its very basic, but cuts out the obvious attempts.

I don't get it either to be honest, as I can't find any sign of damage, files being uploaded, or my mdb being attacked, but the messages in the records on my mdb give the impression that the guys doing this have found something and are exploiting it. Some examples are:

Ni hao!
Check this out!
<a href= ></a>,
----------

And some more..
<a href= ></a> *
--------

At last...
<a href= ></a> *
--------

Salaam!
Check this out!
<a href= ></a>,
--------

Watch Them!
<a href= ></a> *

and so on and so on. There are dozens of them, and I just get the feeling I am missing something and that they are using my site for something beyond my understanding of the fckEditor. It is only the field that uses the fckEditor as its source that is displaying these messages, so I don't think it is a random SQL injection attempt. They seem to be targeting fcked, and I don't know enough about it to really know if anything is being abused or not.

Ash.

Tue, 08/14/2007 - 03:37

#7

n00b32

Joined: 14/08/2007

Posts: 23

Re: Am I being hacked??

do those records do you any harm ? i mean why are you so concerned about them why do you think it is a sql inject ? i think it is just spam.

Tue, 08/14/2007 - 03:40

#8

n00b32

Joined: 14/08/2007

Posts: 23

Re: Am I being hacked??

i think the problem is not a sql inject but an xss inject. i mean you must display those fields somwhere dont you ?

what you shhould do if i am right is to clean up the html code before you put it into the DB. i must assure you that thhis is not an issue of fckeditor . i think ;p;p

Tue, 08/14/2007 - 03:44

#9

ashler

Joined: 14/08/2007

Posts: 6

Re: Am I being hacked??

That sounds more like it... I am not worried about the records, nor the sql injection. I should have made myself more clear I guess. I am worried that they are able to abuse something in fckeditor by using the href parameter of a hyperlink tag to launch something like javascript or php and interrogate my site, or possibly that they are accessing the filemanager components of fcked to upload to my site or navigate my file structure... I have seen articles that suggested these things have been possible with fckEditor, I just haven't seen anyone with the same symptoms as mine.

I believe you when you say fckEditor isn't the cause, I just wasn't sure what I was missing in controlling the situation.

Thanks for your help

Tue, 08/14/2007 - 03:51

#10

n00b32

Joined: 14/08/2007

Posts: 23

Re: Am I being hacked??

oh yeaaa .. so what you should do is clean up the html... i do not know how though , i am a php programmer

second : put a httaccess file in the filemanager directory if you dont use it

i would suggest you to do a regexp on the html. and let through only the allowed tags and attributes and check that the html syntax is not fuckd up wich is often a effect of xss..

and make a replace of "<script" "javascript:" and ect

Tue, 08/14/2007 - 03:55

#11

n00b32

Joined: 14/08/2007

Posts: 23

Re: Am I being hacked??

and delete all the onmouseover onhover onclick onfocus onload ectectect events

Tue, 08/14/2007 - 03:56

#12

ashler

Joined: 14/08/2007

Posts: 6

Re: Am I being hacked??

Thanks for the hints. I am already scouring the web for filtering methods for xss injection, and it is much like you are suggesting. I will read and digest this info and make some changes to my asp to counter it.

You have put my mind at rest, and now I know how to deal with it I can happily go and get my 2 hours sleep before I have to get up for my day job

Many thanks.

Tue, 08/14/2007 - 03:57

#13

n00b32

Joined: 14/08/2007

Posts: 23

Re: Am I being hacked??

no problem bye ;p

Tue, 08/14/2007 - 03:59

#14

n00b32

Joined: 14/08/2007

Posts: 23

Re: Am I being hacked??

//note: i have found a class for filtering html it gote some award from phpclasses... but it is php

Tue, 08/14/2007 - 10:49

#15

ashler

Joined: 14/08/2007

Posts: 6

Re: Am I being hacked??

Could you post a link to a download site, or is it a purchase? I would be interested to have a look.

Tue, 08/14/2007 - 10:56

#16

alfonsoml

Joined: 31/12/2006

Posts: 3737

Re: Am I being hacked??

Ashler wrote:Firstly, I am new to fckEditor. Secondly, I am reasonably new to web development. Thirdly, I have spent ages scouring this forum and the web looking for a concrete answer to what I am about to ask, and although some sites or posts seem to point to an answer I am still confused.

I am running fckEditor on an asp page that writes a feedback form to an access mdb. I recently found a whole bunch of records in my mdb that look something like the following:

At last...
<a href= ></a> *

Now, I am pretty sure I am the victim of a vulnerability exploitation, and I have looked at my fckEditor setup but can't find any sign of actual malicious damage. Can someone please explain to me what these guys are doing, how I can check if they have been successful, and how can I ensure they don't do it in the future? I am using the newest fckEditor release, my filemanager is disabled, and the fckEditor tree is in my web root (which I now understand could be a problem from what I have read on here).

This really has got me baffled, so a detailed explanation would be appreciated. I apologise for having to ask and not being able to figure this out from previous posts, and maybe it is the late hour, but I am just unsure of what is actually happening here.

Ash.

If you have left disabled the filemanager you are way ahead of too many other people that enable it and leave it unprotected.
I wouldn't use FCKeditor for a contact form, instead I would use a plain textarea and then when storing the contents posted escape them using server.HTMLencode, that's the safest solution (apart from watching from SQL injections)

And now back to the problem: Are you sure that they are posting empty links?
the behavior that you have described looks like typical spammers that fill out any contact form that they can find with lots of links to their servers hoping that the links will be shown again to the visitors or to the crawling robots, and they are harmless (although a PITA). In order to get ride of them you can try to add some kind of CAPTCHA (including just one text box asking to fill the url of your domain, spam bots won't recognize it and humans are able to copy & paste)

Tue, 08/14/2007 - 14:32

#17

n00b32

Joined: 14/08/2007

Posts: 23

Re: Am I being hacked??

that will not make the site hack-safe. you have to clean up html for xss. period.

Tue, 08/14/2007 - 14:33

#18

n00b32

Joined: 14/08/2007

Posts: 23

Re: Am I being hacked??

oh yea forgot ;p

http://phpclasses.toperz.pl/browse/package/3717.html
http://phpclasses.toperz.pl/browse/package/2189.html

Tue, 08/14/2007 - 16:52

#19

alfonsoml

Joined: 31/12/2006

Posts: 3737

Re: Am I being hacked??

n00b32 wrote:that will not make the site hack-safe. you have to clean up html for xss. period.

Can you explain how it's possible to achieve an attack if the input has been cleaned with Server.HTMLencode ?

Tue, 08/14/2007 - 20:53

#20

n00b32

Joined: 14/08/2007

Posts: 23

Re: Am I being hacked??

who says it has ???

and if it does then i do not see any point of using fckeditor or any editor come to think of that ....

Wed, 08/15/2007 - 03:35

#21

n00b32

Joined: 14/08/2007

Posts: 23

Re: Am I being hacked??

http://htmlpurifier.org/

Tue, 11/06/2007 - 21:52

#22

alpha2zee

Joined: 06/11/2007

Posts: 2

Re: Am I being hacked??

Have a look at htmLawed, a highly customizable, 45 kb, single file PHP script to filter/purify HTML. Besides restricting tags/elements, attributes and URL protocols as per your specification, and balancing HTML tags and ensuring valid tag nesting/well-formedness, it also has good anti-XSS and anti-spam measures.