I'm looking into the possibility of using Expression Engine to build secure sites. How does the EE core hold up against penetration tests and vulnerability scans that check for things like cross site scripting and SQL injection?

Thanks, RS

  • I didn't see a way to "subscribe" to this thread so I'm posting here. Thanks, Bob.
    – Bob Foster
    Sep 3 '13 at 23:17
  • @BobFoster I think that's what the favorite button is for (star).
    – AllInOne
    Sep 4 '13 at 22:03
  • Uh, Duh, I guess you're right. :-)
    – Bob Foster
    Sep 5 '13 at 19:53

We've had ExpressionEngine installs penetration tested in the past, most recently by the Security Operations team at one of the world's largest technology companies. The key takeaway was that the vast majority of issues were found in third-party add-ons. There were a few issues with ExpressionEngine itself; some of them were fixed in more recent versions of EE.

Many of the remaining EE issues and most of the add-on issues were only accessible via control panel URLs. In some cases, only to logged-in admins. I'm not sure if this is a vulnerability condition for you or if your architecture assumes that admins can be trusted and/or locks the control panel files down behind a firewall. In our case, we hardened the control panel folder in a few ways, including by requiring external OAuth authorization before a session is even started.

It's also worth noting that you're very likely to introduce SQLi and XSS vulnerabilities in your own code. Make sure you're fully testing all get/post params, escaping when displaying user-supplied data, etc.... I'm happy to elaborate if it's helpful!

  • can you say more about how you require OAuth? Is it totally external to EE (or, even PHP), where all access to CP URLs is blocked until the external login is passed? Or, is it another login layer added to the EE CP?
    – Jay F
    Sep 3 '13 at 23:31
  • @JayF We extended the native EE session class to require an authorized OAuth login before a control panel session is allowed to start. Basically, if you don't have an active EE session, and try to access the EE control panel login, we redirect you to an external OAuth flow. If you authenticate through that flow and the verified user information matches specific criteria we're looking for, we log you in and start an EE control panel session.
    – Matt
    Sep 4 '13 at 4:42
  • thanks for the additional details. So it's two-factor authentication -- very smart.
    – Jay F
    Sep 4 '13 at 4:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.