filebrowser vulnerabilities

Don't set $Config['Enabled'] = true ;, check instead with a session variable that the user has been authenticated previously, or set the whole connector folder under a password with .htaccess

// SECURITY: You must explicitly enable this "connector". (Set it to "true").
// WARNING: don't just set "$Config['Enabled'] = true ;", you must be sure that only
// authenticated users can access this file or use some kind of session checking.

You need to restrict the access to any file under the fckeditor folder. this should help you: http://www.htaccesstools.com/htaccess-authentication/

viewtopic.php?f=5&t=5777&p=15427&hilit=+filemanager+hack#p15427

http://www.fckeditor.net

alfonsoml wrote:
run4it wrote:How do they get to the editor if they aren't authenticated? I mean, how do they even know it's on my site?

They just ask the server if several files that they know have weak points exists on your server. If one success, they know that you have installed that piece of software.
Check your server logs for the error 404 and you'll see that they scan lots of things.

some tags to make this post easy to find as I believe it's very important:
file browser manager filebrowser filemanager leak hacked file dump filedump

Wed, 09/17/2008 - 16:09

alfonsoml

Joined: 31/12/2006

Posts: 3735

Re: filebrowser vulnerabilities

There are no vulnerabilities, just the fact that if you simply set enabled=true without any other security then anyone can upload files to your server. A simple fact but it seems too hard to grasp.
And if you have modified the connector to enable deleting of files, then besides uploading new files, an attacker can delete your files.

Wed, 09/17/2008 - 17:10

saul11

Joined: 19/06/2006

Posts: 633

Re: filebrowser vulnerabilities

That sounds like a vulnerability to me. No leak, oke, but really something that makes your server vulnerable te malicious people if you do not take care of it correctly.

If there's no docs on it it can be hard te graps yes, especially the part of why there are no docs on it.

If you're not willing to respond on my questions, then don't respond please.
for anyone else trying to help, please do.

Wed, 09/17/2008 - 18:46

slapinheimer

Joined: 17/09/2008

Posts: 3

Re: filebrowser vulnerabilities

I would put an authentication variable check at the top of my config file to ensure that the user has proper access to the tool. If they don't then they can't use it.

- Slap