3

I followed Magento instruction and added the following rule in the root .htaccess file (inside IfModule mod_rewrite.c>): RewriteRule ^(index.php/?)?rss/ - [L,R=403]

I still can access RSS request page: /index.phprss/catalog/notifystock

Any idea how to block RSS access on 1.7 magento?

https://magento.com/security/best-practices/protect-your-magento-installation-password-guessing-new-update

P.S. I found on the website https://support.hypernode.com/knowledgebase/how-to-protect-your-magento-store-against-brute-force/

"Because the RSS endpoint is reachable under various locations, it is generally not possible to filter RSS when using Apache (without using mod_rewrite). It is recommended to upgrade to at least version 1.9.3 and disable RSS in the backend."

15
  • Did you ensure your website is running on Apache ? Nov 1, 2016 at 8:31
  • Yes it does. I did make sure
    – Icon
    Nov 1, 2016 at 13:54
  • One thing I can see different is you are missing one "?". In the link provided full code is like this: RewriteRule ^(index.php/?)?rss/ - [L,R=403]. However, when I add this code, my DNS stops working and throw unreachable error in browser. Nov 1, 2016 at 23:32
  • Sorry, browser error was redirected you too many times. Nov 1, 2016 at 23:41
  • did you end up fixing the rss error on your end? if so, which mage version you using?
    – Icon
    Nov 2, 2016 at 0:17

6 Answers 6

4

If possible, I would recommend just disabling the Mage_Rss module. See Marius' answer on this question for an example of how to disable core modules.

https://magento.stackexchange.com/a/2664/2241

Zookal has done some research on what modules can be disabled without problems. Of course, if they are not being used. Mage_Rss is on their list of safe modules to disable (see list at the bottom of the page).

http://zookal.github.io/magento-mock/etc/challenges.html

2
  • I guess its hardcore workaround... dont you thing rewrite rule in htaccess would be more conventient?
    – Icon
    Nov 2, 2016 at 19:45
  • That really just depends on your preference. We do not use the Mage_Rss module, so disabling it was the best call for us. It was as simple as adding Zed_Disable.xml in app/etc/modules with the code Marius described, which we can then manage in version control and deploy changes to servers without touching htaccess files. Nov 2, 2016 at 19:52
4

This is what I use to block RSS brute-force.

Right after this block in .htaccess:

############################################
## you can put here your magento root folder
## path relative to web root

    #RewriteBase /magento/

I add this line:

###########################################
## Disable RSS URLs
    RewriteRule ^/?(index.phprss|index.php/rss/catalog|index.php/rss/order|rss/catalog|rss/order).*$ /no-route [R=301,L,NC]
3

Use this rule

RewriteRule ^(index.php/?)?rss/ - [L,F]

instead of the official one:

RewriteRule ^(index.php/?)?rss/ - [L,R=403]

[F] is the semantically correct flag to [F]orbid access.

The reason the official one doesn't work for you might be because of using an older Apache and corresponding mod_rewrite version. It's not fully clear from the mod_rewrite documentation, but in contrast to Apache v2.2 and v2.4, the v2.0 docs don't mention that status codes other than 300-400 are supported. As a result, the rule containing the flag [R=403] as suggested by Magento itself may be skipped under Apache 2.0.

If this is the root cause, then Magento should rework either their system requirements – as they're officially supporting Apache 2.x – or their RSS blocking RewriteRule.

v2.0 docs on [R] flag

'redirect|R [=code]' (force redirect)

Prefix Substitution with http://thishost[:thisport]/ (which makes the new URL a URI) to force a external redirection. If no code is given, a HTTP response of 302 (MOVED TEMPORARILY) will be returned. If you want to use other response codes in the range 300-400, simply specify the appropriate number or use one of the following symbolic names: temp (default), permanent, seeother. Use this for rules to canonicalize the URL and return it to the client - to translate /~'' into/u/'', or to always append a slash to /u/user, etc.

[...]

v2.2 and v2.4 docs on [R] flag

[...]

Any valid HTTP response status code may be specified, using the syntax [R=305], with a 302 status code being used by default if none is specified. The status code specified need not necessarily be a redirect (3xx) status code. However, if a status code is outside the redirect range (300-399) then the substitution string is dropped entirely, and rewriting is stopped as if the L were used.

[...]

3

To Block RSS brute-force attack. Add that rule in root .htaccess file. Modified answer of @Richard Feraro

Note: it should be written before enable rewrites code RewriteEngine on

<IfModule mod_rewrite.c>

RewriteRule ^/?(index.phprss|index.php/rss/catalog|index.php/rss/catalog/notifystock|rss/catalog/notifystock|index.php/rss/order|rss/catalog|rss/order).*$ / [R=301,L,NC]

</IfModule>
2

Try this

RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} ^.*/RSS/CATALOG [OR,NC] 
RewriteCond %{REQUEST_URI} ^.*/RSS/ORDER [OR,NC]
RewriteCond %{REQUEST_URI} ^.*RSS/CATALOG [NC]  
RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L] 

RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} ^.*/RSS/CATALOG [OR,NC] 
RewriteCond %{REQUEST_URI} ^.*/RSS/ORDER [OR,NC]
RewriteCond %{REQUEST_URI} ^.*RSS/CATALOG [NC]  
RewriteRule ^(.*)$ https://%{HTTP_HOST}/ [R=302,L] 
0
  1. System -> Configuration
  2. Search RSS Feed.
  3. In the Catalog section, you will find RSS Feed option. Disable it from this panel.
  4. After disabling refresh the cache.
1
  • 1
    it doesnt fully disalbe rss... i tried it
    – Icon
    Nov 1, 2016 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.