Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a .htaccess solution against this attack

188.165.198.65 - - [17/Apr/2010:15:46:49 -0500] "GET /blog/2009/04/12/shopping-cart/?cart=../../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 28114""Mozilla/4.0 (compatible; MSIE 7.0;Windows NT 5.1; .NET CLR 1"

my WordPress .htaccess is

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /blog/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /blog/index.php [L]
</IfModule>

# END WordPress
share|improve this question

1 Answer 1

First of all, don't panic. Attacks like this almost always won't work, but that's not to say you shouldn't protect against them.

If you are running your own server then look into the mod_security module, which will protect against directory traversal attacks like this as well as many other attacks. It can be a little awkward to set up and get working properly, but it's worth it.

Also make sure you are running the latest version of WordPress, plugins and themes and that your server software doesn't have any vulnerabilties.

share|improve this answer
    
Thanks to plugins I'm stuck to WP 2.9. I use cPanel I don't have access to Apache mods. Can this be solved with .htaccess? –  Anonymous Apr 18 '10 at 11:44
    
There are two particularly bad vulnerabilities in WordPress 2.9.0, you really need to upgrade. There shouldn't be any plugins which work with 2.9 but don't work with 2.9.2. –  kaerast Apr 18 '10 at 11:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.