0

Is there a .htaccess solution against this attack

188.165.198.65 - - [17/Apr/2010:15:46:49 -0500] "GET /blog/2009/04/12/shopping-cart/?cart=../../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 28114""Mozilla/4.0 (compatible; MSIE 7.0;Windows NT 5.1; .NET CLR 1"

my WordPress .htaccess is

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /blog/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /blog/index.php [L]
</IfModule>

# END WordPress

1 Answer 1

1

First of all, don't panic. Attacks like this almost always won't work, but that's not to say you shouldn't protect against them.

If you are running your own server then look into the mod_security module, which will protect against directory traversal attacks like this as well as many other attacks. It can be a little awkward to set up and get working properly, but it's worth it.

Also make sure you are running the latest version of WordPress, plugins and themes and that your server software doesn't have any vulnerabilties.

2
  • Thanks to plugins I'm stuck to WP 2.9. I use cPanel I don't have access to Apache mods. Can this be solved with .htaccess?
    – Anonymous
    Apr 18, 2010 at 11:44
  • There are two particularly bad vulnerabilities in WordPress 2.9.0, you really need to upgrade. There shouldn't be any plugins which work with 2.9 but don't work with 2.9.2. Apr 18, 2010 at 11:54

You must log in to answer this question.