1

I noticed this weekend that someone was pounding on /rss/catalog/notifystock/ trying to brute force the admin credentials. I've added a line to the nginx vhost.d conf that returns 403 when you attempt to visit /rss/catalog/notifystock/ effectively blocking this attack. I've also blocked /rss/order/new and /rss/catalog/review as I discovered they were vulnerable during my research.

When I check the nginx access log I still see them pounding away. The access log shows it is returning a 301 instead of the 403 they should be seeing. Any ideas on why I might be seeing the 301?

0

Do you need /rss?

If not, just do this in your nginx server {} block

location ~ ^/index.php/?rss/ {
    deny all;
}
location ~ ^/rss/ {
    deny all;
}
  • There are a couple of RSS feeds that the client is using. The server block in nginx.conf in commented out and the conf.d and vhost.d conf files are being used. – user68760 Jun 26 '18 at 17:58
  • in that case, it might make sense to block all /rss except the url's your client is using? – Ricky Odin Matthews Jun 27 '18 at 8:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.