Not a bug An issue has been discovered with the controller

Sado Yasashii

Sado Yasashii

Active member
Affected version
2.3.7
An error has been discovered where the controller::
  • in XF 2.2. * –XF\Admin\Controller\Login
  • in XF 2.3. * –XF\Admin\Controller\LoginController
does not work correctly if you enter a URL like https://site.com////admin.php in the browser. No matter how many slashes are added before admin.php, the page will still open, even if direct URL access is forcibly restricted.

The issue was discovered while addressing the problem of redirecting guests to the homepage when attempting to access the admin panel via https://site.com/admin.php. It has been confirmed that this bug is present in both XF 2.3 and XF 2.2.

To reproduce the error, you need to access the admin panel URL with multiple slashes as a guest.

This is a rather serious vulnerability.

Please investigate.
 

Attachments

  • An issue has been discovered with the controller.webp
    An issue has been discovered with the controller.webp
    10 KB · Views: 13
Last edited:
Sado Yasashii said:
does not work correctly if you enter a URL like https://site.com////admin.php in the browser. No matter how many slashes are added before admin.php, the page will still open, even if direct URL access is forcibly restricted.
Click to expand...
How are you restricting access to admin.php? This method doesn't work on 2.3.6 with admin.php protected at the server level. (NGINX)
XF doesn't provide explicit protection against URL entry to the ACP login page... we usually setup an additional layer above that to prevent people from accessing the page.
 
ENF said:
How are you restricting access to admin.php? This method doesn't work on 2.3.6 with admin.php protected at the server level. (NGINX)
XF doesn't provide explicit protection against URL entry to the ACP login page... we usually setup an additional layer above that to prevent people from accessing the page.
Click to expand...
This plugin (XF2-ProtectACP) was originally used to handle guest redirection in XF 2.2., but it doesn’t work in XF 2.3. After examining the code to adapt it for 2.3, it turned out that due to the bug mentioned above, the plugin fails to function properly and still allows guests to access the admin panel. If not for this issue, the problem might have gone unnoticed.

Managed to fix the access issue by modifying the plugin’s code, but it would be ideal if the core XF version addressed the controller handling bug to ensure proper security.
 
It’s really not a controller level / application level bug. This is just how most web servers handle URLs.

If the add-on has been updated to resolve this issue, that is likely the best course of action.
 
Back
Top Bottom