3

I followed Magento instruction and added the following rule in the root .htaccess file (inside IfModule mod_rewrite.c>): RewriteRule ^(index.php/?)?rss/ - [L,R=403]

I still can access RSS request page: /index.phprss/catalog/notifystock

Any idea how to block RSS access on 1.7 magento?

https://magento.com/security/best-practices/protect-your-magento-installation-password-guessing-new-update

P.S. I found on the website https://support.hypernode.com/knowledgebase/how-to-protect-your-magento-store-against-brute-force/

"Because the RSS endpoint is reachable under various locations, it is generally not possible to filter RSS when using Apache (without using mod_rewrite). It is recommended to upgrade to at least version 1.9.3 and disable RSS in the backend."

  • Did you ensure your website is running on Apache ? – Raphael at Digital Pianism Nov 1 '16 at 8:31
  • Yes it does. I did make sure – Icon Nov 1 '16 at 13:54
  • One thing I can see different is you are missing one "?". In the link provided full code is like this: RewriteRule ^(index.php/?)?rss/ - [L,R=403]. However, when I add this code, my DNS stops working and throw unreachable error in browser. – Adarsh Khatri Nov 1 '16 at 23:32
  • Sorry, browser error was redirected you too many times. – Adarsh Khatri Nov 1 '16 at 23:41
  • did you end up fixing the rss error on your end? if so, which mage version you using? – Icon Nov 2 '16 at 0:17
4

This is what I use to block RSS brute-force.

Right after this block in .htaccess:

############################################
## you can put here your magento root folder
## path relative to web root

    #RewriteBase /magento/

I add this line:

###########################################
## Disable RSS URLs
    RewriteRule ^/?(index.phprss|index.php/rss/catalog|index.php/rss/order|rss/catalog|rss/order).*$ /no-route [R=301,L,NC]
3

If possible, I would recommend just disabling the Mage_Rss module. See Marius' answer on this question for an example of how to disable core modules.

https://magento.stackexchange.com/a/2664/2241

Zookal has done some research on what modules can be disabled without problems. Of course, if they are not being used. Mage_Rss is on their list of safe modules to disable (see list at the bottom of the page).

http://zookal.github.io/magento-mock/etc/challenges.html

  • I guess its hardcore workaround... dont you thing rewrite rule in htaccess would be more conventient? – Icon Nov 2 '16 at 19:45
  • That really just depends on your preference. We do not use the Mage_Rss module, so disabling it was the best call for us. It was as simple as adding Zed_Disable.xml in app/etc/modules with the code Marius described, which we can then manage in version control and deploy changes to servers without touching htaccess files. – quasiobject Nov 2 '16 at 19:52
3

Use this rule

RewriteRule ^(index.php/?)?rss/ - [L,F]

instead of the official one:

RewriteRule ^(index.php/?)?rss/ - [L,R=403]

[F] is the semantically correct flag to [F]orbid access.

The reason the official one doesn't work for you might be because of using an older Apache and corresponding mod_rewrite version. It's not fully clear from the mod_rewrite documentation, but in contrast to Apache v2.2 and v2.4, the v2.0 docs don't mention that status codes other than 300-400 are supported. As a result, the rule containing the flag [R=403] as suggested by Magento itself may be skipped under Apache 2.0.

If this is the root cause, then Magento should rework either their system requirements – as they're officially supporting Apache 2.x – or their RSS blocking RewriteRule.

v2.0 docs on [R] flag

'redirect|R [=code]' (force redirect)

Prefix Substitution with http://thishost[:thisport]/ (which makes the new URL a URI) to force a external redirection. If no code is given, a HTTP response of 302 (MOVED TEMPORARILY) will be returned. If you want to use other response codes in the range 300-400, simply specify the appropriate number or use one of the following symbolic names: temp (default), permanent, seeother. Use this for rules to canonicalize the URL and return it to the client - to translate /~'' into/u/'', or to always append a slash to /u/user, etc.

[...]

v2.2 and v2.4 docs on [R] flag

[...]

Any valid HTTP response status code may be specified, using the syntax [R=305], with a 302 status code being used by default if none is specified. The status code specified need not necessarily be a redirect (3xx) status code. However, if a status code is outside the redirect range (300-399) then the substitution string is dropped entirely, and rewriting is stopped as if the L were used.

[...]

2

Try this

RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} ^.*/RSS/CATALOG [OR,NC] 
RewriteCond %{REQUEST_URI} ^.*/RSS/ORDER [OR,NC]
RewriteCond %{REQUEST_URI} ^.*RSS/CATALOG [NC]  
RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L] 

RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} ^.*/RSS/CATALOG [OR,NC] 
RewriteCond %{REQUEST_URI} ^.*/RSS/ORDER [OR,NC]
RewriteCond %{REQUEST_URI} ^.*RSS/CATALOG [NC]  
RewriteRule ^(.*)$ https://%{HTTP_HOST}/ [R=302,L] 
2

To Block RSS brute-force attack. Add that rule in root .htaccess file. Modified answer of @Richard Feraro

Note: it should be written before enable rewrites code RewriteEngine on

<IfModule mod_rewrite.c>

RewriteRule ^/?(index.phprss|index.php/rss/catalog|index.php/rss/catalog/notifystock|rss/catalog/notifystock|index.php/rss/order|rss/catalog|rss/order).*$ / [R=301,L,NC]

</IfModule>
0
  1. System -> Configuration
  2. Search RSS Feed.
  3. In the Catalog section, you will find RSS Feed option. Disable it from this panel.
  4. After disabling refresh the cache.
  • 1
    it doesnt fully disalbe rss... i tried it – Icon Nov 1 '16 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.