Checking for XSS and dodgy patch to fix. - Joomla! Forum - community, help and support

having been notified 1 of sites after had xss vunerability. :-[

i suggest check sites not on website http://www.xssed.org 

i have hacked comment preventing vote option prevent xss until such time true fix occurs.

there loads of joomla sites affected. hi!
i try in english, hope can understand
i thing best can is  don't use vulnerable extensions; but, if not sure that, can try 1 "extra protection"

can use .htaccess  + mod_rewrite?

this 1 can stop lot of xss intrusions, scanners, etc:

code: select all

rewriteengine on

options +followsymlinks
#evitar escaneos y cualquier tipo de inyección o manipulación malintencionada
# de la url. con esta regla es imposible lanzar ataques de inyección (sql, xss,
#etc)
rewritecond %{http_user_agent} ^$ [or]
rewritecond %{http_user_agent} ^(-|\.|') [or]
rewritecond %{http_user_agent} ^(.*)(<|>|%3c|%3e)(.*) [nc,or]
rewritecond %{http_user_agent} ^(java|curl|wget)(.*) [nc,or]
rewritecond %{http_user_agent} ^(.*)(libwww-perl|libwwwperl|snoopy|curl|wget|winhttp|python|nikto|scan|clshttp|archiver|loader|email|harvest|fetch|extract|grab|miner|suck|reaper|leach)(.*) [nc,or]

rewritecond %{request_uri} ^(/,|/;|/<|/>|/'|/`|/%2c|/%3c|/%3e|/%27|/////) [nc,or]
rewritecond %{http_referer} ^(.*)(%00|%08|%09|%0a|%0b|%0c|%0d|%0e|%0f|%2c|<|>|'|%3c|%3e|%26%23|%27|%60)(.*) [nc,or]
rewritecond %{query_string} ^(.*)(%00|%08|%09|%0a|%0b|%0c|%0d|%0e|%0f|%2c|%3c|%3e|%27|%26%23|%60)(.*) [nc,or]
rewritecond %{query_string} ^(.*)('|-|<|>|,|/|\\|\.a|\.c|\.t|\.d|\.p|\.i|\.e|\.j)(.*) [nc,or]
rewritecond %{http_cookie} ^(.*)(<|>|'|%3c|%3e|%27)(.*) [nc]
rewriterule .* - [f]
# optional, if want redirect forbidden error url, uncomnent next line
# errordocument 403 http://www.domain.com


try 1 carrefully, working fine me on "test-site"; but, practce recent. found original lines in ]www.0x000000.com  , change last "rewiterule" original.


you can enable rules configuring directly "virtual file" or "httpd.conf/apache2.conf of server)

you can aply same protection, using particular mod_security rules, "mod_security" (using .htaccess enable rules or configuring  directly "virtual file" or "httpd.conf/apache2.conf)

cheers