0

We're hosing a site built with EE v2.10.1. As part of our hosting agreement I’ve had to run a vulnerability scan.

The scan found 23 CRLF injection/HTTP response splitting vulnerabilities.

Is this likely to be an EE issue or as a result of the way the site is coded?

I have the report that I could send to a EE support contact if it helps.

Thanks

Wayne.

Here is an example of the error in the report.

`Affected items

/

Details Path Fragment input was set to SomeCustomInjectedHeader: injected_by_wvs Injected header found: SomeCustomInjectedHeader: injected_by_wvs

GET /index.php/template-group/template-name/some-title-here%0dSomeCustomInj ectedHeader:%20injected_by_wvs-2013 HTTP/1.1 Referer: http://domain.com Cookie: exp_last_visit=1127726290; exp_last_activity=1443086299; exp_tracker=%7B%220%22%3A%22font-awesome.css%22%2C%221%22%3A%22corporate%2Fcorporate-inf ormation%2Fcharity%22%2C%222%22%3A%22corporate%2Fcorporate-news%2Ftite-here%22%2C%223%22%3A%22corporate%2Fnews%22%2C%224%22%3A%22 good2freeze%2Fdetail%22%2C%22token%22%3A%2200636beb8451791776252ab2ef30c264%22%7D; exp_csrf_token=13e5fd3fee3d9d10383fc125f3cb6ef2197cc286; cb-enabled=accepted Host: www.domain.com Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21 Accept: /`

The scan was run on a developed site using Acunetix Vulnerability Scanner

Improve this question
4
  • This is kind of vague. Could you post a few example CRLF issues the report found? I'm intrigued, but honestly in doubt that EE is at fault. They never had a major breach of their framework. Was the scan run after some development, or is the scan on a vanilla, untouched install?
    – jrothafer
    Commented Sep 25, 2015 at 13:22
  • What software did you use to run the scan? Depending on the settings, they can throw lots of false positives. It could be a lot of things. Does it tell you where it found the vulnerabilities? I've had scanners tell me there were vulnerabilities on completely blank pages.
    – Jim Wyse
    Commented Sep 25, 2015 at 14:17
  • Well if the site is developed (I mean no offense...), and that error there is tracked to a template that obviously Ellis didn't develop, I think the culprit here isn't EE... at least in the example you posted.
    – jrothafer
    Commented Sep 25, 2015 at 14:24
  • This is the scanner I used acunetix.com/vulnerability-scanner/… The vulnerabilities where found in: Path input .php/ was set to SomeCustomInjectedHeader: injected_by_wvs
    – Deswork
    Commented Sep 25, 2015 at 14:28

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.