Urgent Forum Security Information (DotNetNuke Core Forum)
As you all have noticed from my post above today I identified an issue with a javascript exploit on the forums module. This blog will give you step-by-step instructions on a few simple additions to the word filter that should prevent you from being affected by the exploit.
NOTICE: I have identified this exploit and I have notified the DotNetNuke core team regarding what happened to my site. I do not know the scope of this issue, however, since I have identified a workable solution I wanted to be sure to share it with the community as soon as possible.
My recommended solution is to add word filters to remove potentially harmful pieces of code and to replace them with non-harmful text. This is not the most elegant solution as the display to the users might be a little unusual, however this will ensure that your forums are not exploited in a manner that would be harmful.
The following is a listing of the recommended match and replacement text. My recommendations are to prevent the insertion of javascript and javascript only, you can continue and add other replacements if you have other input that you would like to prevent. You can put anything you desire as the replacement text, but I recommend that you use the exact match text to ensure the best possible matching. After this listing I will show you how using the forums admin to set these values in the system.
| Match Text | Replacement Text |
|---|
| <script | Begin Script |
| </script> | End Script |
To add these to the word filter in the forums module you must be logged in as an administrator, then follow the below steps.
- From the SolPart action menu select "Forum Administration"
- Click on the link for "Word Filter"
- Click on "Add Word"
- In the "Word to filter" box type the item listed in the "Match Text" listing above
- In the "Word to replace" box type the item listed in the "Replacement Text" listing above
- Press "Update" to add the word
- You will then see the listing of words to filter, you will notice that the word to filter column is blank, this is due to the HTML not being filtered and converted. Do not worry your input was saved. (Screen show below shows the display)
- Repeat from step 3 to add additional words
Figure 1: Word Filter Display
By performing the above additions to your forum module you should be able to fully protect yourself from script injection. REMEMBER, as I noted before these are ONLY my observations and this process is provided for your information only and does not come with any warrantee expressed nor implied that it will fully protect your site. If you have any questions regarding this post please feel free to e-mail me directly or comment below!
Posted by Mitchel on Thursday, March 29, 2007
Name (required)
Email (required)
Website