Admin Tools

#36757 DFIShield false positive

Posted in ‘Admin Tools for Joomla! 4 & 5’

This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version

n/a

PHP version

n/a

Admin Tools version

n/a

Latest post by n3t.cz on Tuesday, 08 March 2022 15:59 CST

Tuesday, 08 March 2022 14:47 CST

n3t.cz

I found Admin Tools false positive blocking requests containing field with value "/" (without quotes, just slash). The request is blocked by DFIShield, as in it is called "file_exists" function on every value, which for slash returns true on linux. Users sometime use just slash to indicate empty field (however don't ask me why:)).

Is there some way how to bypass this check for this special value? I tried replacing file_exists with is_file in DFIShield, and it works, howeever not sure with security consequences.

Thanks, Pavel

Edited by n3t.cz on 2022-03-08 14:47 CST

Tuesday, 08 March 2022 15:51 CST

nicholas

The use of file_exists is deliberate as it's trying to make sure that any valid path (file, directory, symlink, device, pipe, ...) is not passed in the URL. Yes, a single slash will also cause it to trigger on any UNIX–based OS, practically anything except Windows. There's no workaround since there is no context on whether this parameter contains a path or plain text. You can use the WAF Exceptions feature to have specific fields (even in specific components and/or views) ignored when applying the Web Application Firewall rules.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Tuesday, 08 March 2022 15:59 CST

n3t.cz

Ok, thanks for explanation, It's just that DFIShield option in WAF configuration says "When this option is enabled, Admin Tools will search the request parameters for anything which looks like a file path. If one is found, it will be scanned. If it is found to contain PHP code, the request will be rejected.", which in this case is not true. Maybe the description should be changed to reflect this also. It is porpably not very common case (I have first complaint on this in last maybe 10 years), but the description is bit confusing when looking for reason why request was blocked...

Pavel

Support