FCKeditor vulnerability

[Patrick M Monkelban, geändert vor 14 Jahren.]

A security vulnerability has been found in older versions of FCKeditor. We're running Liferay version 4.3.4 which comes with FCKeditor version 2.4.3. The vulnerability was identified in FCKeditor version 2.2, but likely exists in version 2.4.3 as well.

See http://secunia.com/advisories/18767/

Therefore, we're looking to upgrade FCKEditor to 2.6.4, the latest version.

Has anyone successfully done this before?

Is it just a matter of replacing the ROOT/html/js/editor/fckeditor directory with the contents from the new version?

Any guidance is appreciated. Thanks.

[Olaf Kock, geändert vor 14 Jahren.]

Wow - this note is from february 2006...

I've done a fckeditor update just the way you described for pebble, a blogging engine. Just replaced the fckeditor directory content, then fixed some stupid mistakes I made in the fck-editor configuration as pebble usually displays two fckeditor instances at once, and was finished. (Can't tell what version it was before...)

To try it should be fairly easy, also the results should be easy to verify - e.g. are you still able to edit and use it or not.

If you are not successful, you might want to diff the fckeditor directory contents from your liferay version with the matching fckeditor-release version in order to find if there were tweaks made.

Sorry - I can only provide this somewhat abstract help...

[Jonas Yuan, geändert vor 14 Jahren.]

Hi Patrick and Olaf,

Thank you both. Liferay portal could integrate with FCKEditor easily.

Yes, the Integration (demo) Liferay portal 5.3 and FCKEditor to 2.6.4 is here:

http://liferay.cignex.com

login in as "jonas/jonas"

Fortunately, you can do it yourself, according the chapter 6: Customizing WYSIWYG editor (FCKEditor).

Hope that it helps.

Thanks

Jonas Yuan

-----------------
Liferay Books

Liferay Portal 5.2/5.3 Systems Development
Liferay Portal 4.4/5.0 Enterprise Intranets

[Patrick M Monkelban, geändert vor 14 Jahren.]

Thank you both.

I'll give it a try. Hopefully it will go as easy as it sounds.

[Lisa Simpson, geändert vor 14 Jahren.]

What about alternative editors - like TinyMCE ???

[Jan Geißler, geändert vor 8 Jahren.]

First of all, please don't revive year old threads. Create a new One. The possibility that the information in an old thread is outdated is to damn high ;)
Next: What version of Liferay do you use? What Editor Version is bundled with that release? Does this Version even have the vulnerability?

[David H Nebinger, geändert vor 8 Jahren.]

Cyber Katze:

how can I disable to view this folders??

***/html/js/editor/fckeditor/editor/***

we have many times hack-injection to check this editor like as:

<bad-host> - - [10/Jun/2015:15:08:37 +0100] "GET /dekra/FCKeditor/editor/fckeditor.html HTTP/1.1" 404 26734
<bad-host> - - [10/Jun/2015:15:08:38 +0100] "GET /c4sql8-solidarieta/html/images_sys/fckeditor.o/editor/fckeditor.html HTTP/1.1" 404 26840

Jan is right, should have opened a new thread.

That said, you cannot block access to the editor folder, those files are necessary for the editor to work.

However, the errors you're seeing are tied to a lot of web apps that have known vulnerabilities; they're feeding the apps into the script, so it's not a generic search for the files across the board.

I'd add general rules to block the base urls such as "/webmail", "/adminicpsb", etc. That's what the bad guys are probing for, not necessarily the fckeditor itself.

As a bad guy, once you find a site with the fckeditor with the issue, you then start to exploit it but that exploitation will be different depending upon the application it's running under. The "/webmail" guy, for example, well you'd take one path that probably is different than the "/drupal" path.

Blocking the root app is the better path in case some other vulnerability is found in those packages, you won't be scanned for those either.