Partial fix Affiliate Spammers can exploit/abuse the proxy function too easily

Alpha1

Alpha1

Well-known member
Licensed customer
Affected version
2.3.9
Spammers are heavily abusing the proxy.php function. I have 40K malicious links like this in my Google Search Console:
proxy.php?link=spamlinkhere
proxy.php?aff-xxxx&link=spamlinkhere
None of these links exist on my website, so these are malicious backlinks to proxy.php to use my site to promote spam sites and affiliate links.
This affects crawl budget and may affect site authority and ranking. proxy.php can also drain server resources.

Suggested solution: add a setting to block proxy.php for guests.

Please also see these related threads:
www.xendach.de

XF1+2 - Spamlinks durch externe Verweise mit der proxy.php von xenforo

Google zeigt mir gerade in der Search Console tausende Linkfehler, die aber nicht direkt bei mir sind, sondern durch externe Seiten kommen, die aber auf meine proxy.php verweisen. Ein Link sieht dann extern so aus...
www.xendach.de www.xendach.de
K

Closed Thread 'Image proxy always returns status code 200'

No matter if an image exists or not and if the hash (if required) is correct or not - the image proxy always returns status 200.

This is IMHO semantically wrong and Google seems to consider such URLs as "soft 404".

Suggested Change
Return 404 if no image exists (or 410 it it existed in the past but was pruned)
Return 400 (or 403) if a required hash is missing or wrong
  • Like
K

Closed Thread 'Image proxy can be abused too easily'

Steps to reproduce
  1. Configure a proxy secret
  2. Start a new post
  3. Insert an external image
  4. Click preview
  5. Copy the generated image URL
Result
The generated proxy.php URL can now be used externally forever until the secret is changed without the image ever being displayed anywhere publically in XenForo

Suggested Mitigation
Make the hashes automatically expire after a configurable expire time
  • Like
 
Automated triage: As designed

Thank you for reporting this issue. The link proxy never redirects to the address in the URL. Links without a valid site-specific signature get an error response, and nothing is fetched or logged. External links to such addresses cannot send visitors to the spam site, and no site can stop others linking to it. A setting to block the proxy for guests would be a feature suggestion.

This is an automated assessment. A member of staff may review and update it.
 
Black hat SEO tactics exploiting a SEO vulnerability
I dont think the bot has truly considered the examples linked in this thread, nor understood the issue reported without that context. To elaborate:

This malicious url exists on xenforo.com

If a spammer place it on another website, the link will return 403 forbidden status code, which states the page is a valid page on the website. It does not return a 404 Not found. Status code check for this URL showing 403 Forbidden here:
www.debugbear.com

HTTP Status Checker: Analyze Server Response Code

View the HTTP status code and response headers returned by a website. Validate cache settings, Content Security Policies, server settings, and more.
www.debugbear.com www.debugbear.com

Therefore Google will index the page as a valid link. This costs crawl budget and thereby does damage in this manner.
Apparently, spammers found it in their benefit to posts thousands of such links and persist doing so: The 403 link implies affiliation with spammers. Possibily leaking page rank to the spammer and boosting the referred link ranking. And possibly does damage to our websites ranking in this second manner.
It seems a black hat SEO tacticts exploiting a SEO vulnerability on xenforo.

For us it makes proxy.php unusable and the abuse of this functionality forced us to disable proxy.php completely. Which I advice to any webmaster who wants safeguard their website SEO position.


Not a suggestion

XF Bug Bot said:
A setting to block the proxy for guests would be a feature suggestion.
Click to expand...
In my experience, it falls outside the scope of what xenforo processes as a suggestion. I've submitted hundreds of suggestions and know from experience that such suggestion would never be voted on, nor considered for implementation. It would be completely pointless as a suggestion. Its no different than this:
XF Bug Bot said:
adding expiring links would be a design change.
Click to expand...
I can understand why the bot has evaluated guest blocking to be a suggestion and adding an expiring links feature to be a design change, but its fundamentally incorrect.

Possible fixes
Disabling proxy.php to guests is just one possibile solution. A better solution would be to return a 404 on the page, like it should.
 
I've checked this and that URL doesn't actually return a 403. It returns a 400 with a small JSON error. The 403 you saw comes from Cloudflare blocking the status checker rather than from XenForo. Unsigned link proxy URLs are rejected anyway, they don't redirect, nothing is fetched and nothing is logged. So there's nothing I can see that passes to the spammer's site. A 400 isn't treated as a valid page either, and a 404 wouldn't really change anything there.

But we will be making a partial fix: proxy.php will send an X-Robots-Tag: noindex header on its responses. That makes it explicit to search engines that nothing served by the proxy should be indexed.
 
Back
Top Bottom