How to block users uploading malware to your blog?

While researching ways to better protect my blog, I discovered a loophole typical for selfhosted sites on shared servers, such as GoDaddy.

The loophole concerns all PHP based CMS (Contents Management Systems), including WordPress, Drupal, Joomla, phpBB, etc…: Many of them allow users to upload files: Forums allow attachments to posts, users can upload their avatar in .jpg format, some comment systems allow code to be embedded. Combine this with shared-hosting services like mine, GoDaddy, which allow files without the .php extension to be executed as if they were PHP code, and you have a hacker’s bomb.

Here is how you can simulate a file drop hack:

1. Create a simple text file with a simple text editor and put the following PHP code in it:
   

   php
phpinfo();
?>

   This code does no harm. The command only displays the basic PHP variables for your site, but a hacker could put any malicious PHP code in it, including code that modifies all files on your site.

2. Save it as test.php.jpg
3. FTP it to the root of your site
4. Execute it in your browser (and you don’t have to be logged in) as: http://www.yoursite.com/test.php.jpg
5. If you get a “Page not Found” error, you are cool, and your hosting service protects you from this hacking method. But if you see something like this screen, the output from the php-code you just uploaded, your host is vulnerable:


… and if the code were malicious, the user just dropped a hacker’s bomb on your site….

Sure enough, a user does not have FTP access to your site (I hope!). But… as long as he can upload the file, even as a disguised .jpg file as in our example, and figure out where the uploaded file  is stored in your site’s file structure, he can execute it.

How can you can protect your blog from users uploading disguised PHP file? This documented vulnerability can be corrected by adding some code at the bottom of your .htaccess file in the root directory of your blog (or any PHP-based CMS):

1. As for any changes you make to any file on your site, first backup the .htaccess file, so you can roll back in case it does not work for you.
2. Edit the .htaccess file and add the following piece of code at the bottom:
   

   # BEGIN drop-file hack stopper
RemoveHandler application/x-httpd-php .php
<FilesMatch ".(php|php5|php4|php3|phtml|phpt)$">
SetHandler x-httpd-php5
FilesMatch>
<FilesMatch ".phps$">
SetHandler x-httpd-php5-source
</FilesMatch>
# END drop-file hack stopper

3. Upload the modified .htaccess file to your root directory
4. Now, assuming you still have the test.php.jpg on your root directory, try executing it again with the same command: http://www.yoursite.com/test.php.jpg

If now, you get a ‘Page not Found’ error, then you are protected. At least for this hack, that is.

One word of caution: this was NOT the method used in the most recent massive hack affecting thousands of sites, as described in this post, but at least it closes one more door for hackers. A door which gives them unlimited access to your website.

Safe blogging!

Cartoon courtesy Life on the Homefront

Tagged as: Drupal, hackers, hosting, security, tips, tools, WordPress