Critical security issue fix for all 2.X versions

Hi Andrei,

Just a few questions here regarding the fix:

1. Do we have to apply the fix to other web.configs? (Example: the web.config in the Admin area).

For now, I have only applied the fix to Nop.Web/web.config

2. How do I test the site to know if the fix has been applied properly?

3. Can this fix potentially break anything on the site? (can you point out what they may be?)

Thanks for your time!

jamestie wrote:
1. Please read my original post: "Open web.config file in the root of your site"

2. As I've already written I cannot share any issue details. Otherwise, I'll tell how to hack other sites

3. No

Hi All,

I have been working on a problem which I asked a question about here. https://www.nopcommerce.com/boards/t/23954/product-secification-attributes-inline-editing-of-options.aspx#98289

Anyway I solved it by doing some JavaScript stuff around the Telerik Grid and DropDownList controls.

One thing I had to do to get the JavaScript working with the telerik controls was to put the Line back into web.config that this thread talks about removing.

I totally agree with not discussing the vulnerability but can I ask if I were to add the Telerik JavaScript libraries manually to would this still be an issue, and would this work  (I have not had chance to try that yet).




Thanks for any thoughts.



Paul

If you have asset.axd in your root web.config file, your site is vulnerable

a.m. wrote:

Sent you a PM. Glad I found this.

thanks

Hi all, the first part of my code looks like below. Has it been fixed already??????????

  <add verb="GET,HEAD" path="asset.axd" validate="false" type="Telerik.Web.Mvc.WebAssetHttpHandler, Telerik.Web.Mvc" />
    <!--Uncomment the following lines in order to enabled static file caching and compression for IIS 6
    <remove verb="GET,HEAD,POST" path="*" />
    <add verb="GET,HEAD,POST" path="*" type="Nop.Web.Framework.StaticFileHandler" />-->

nmmhi wrote:
No, it's not fixed. Please read the first post in this topic

a.m. wrote:

So it's ok to delete only what was described in the first post and leave this part alone? : <!--Uncomment the following lines in order to enabled static file caching and compression for IIS 6 <remove verb="GET,HEAD,POST" path="*" />

Delete only what is described in the first post. I would write about any other code if it was required to delete it too.

Thanks wasn't sure if someone else added that. I will delete only what you said and save the file.