Hi,
could you please release a patch for SP Page Builder for Joomla 3 and related Helix? There are still plenty of sites which can't be migrated due to other customization and looks like the hackers exploited some of the vulnerabilities that you fixed for SP Page Builder 6.6.2.
It is critical. Thank you.
Or any way we can disable the iconfont upload? I assume by disabling the icon addon (havent looked into it).
I have one site which 'will be migrated to Odoo' any time (the customer says this for over a year). It keeps getting delayed due to regulations at the franchise.
Hello,
We sincerely apologize for the inconvenience caused.
Please follow this post as a work around, there is no option to disbale custom icon upload from settings: https://www.joomshaper.com/forum/question/45258
You can also use the following security scanner to help identify malicious files and delete them: https://github.com/zkrana/joomla-security-scanner
Please make sure to read the README.md file in the repository for instructions on how to run the tool.
After completing the cleanup and upgrading to v6.6.2, please let us know the outcome or if you need any further assistance.
We'll be happy to help.
Thank you.
I am using mysites.guru which works fine for the scan, but good alternative you mentioned. The issue is that version 6.x is not working with Joomla 3.x. Well the main issue is Joomla 3.x still being active offcourse :)
Great.
Please, let us know the update.
I ended up removing a lot of lines (for font upload) from the asset.php file. Since than I am not getting any odd uploads in my Joomla 3.x site with SP Pagebuilder 3.x.
Also used Mysites.guru to apply some other Joomla 3.x fixes, including things which have been patched by the eLTS program. See the Mysites.guru blog here (btw I am in no way affiliated with them):
https://mysites.guru/blog/how-to-fix-joomla-3-security-issues-with-a-single-click/
Thanks
If everything is working fine now, please mark the question as complete by accepting any of our answers.
Thank you!
I would rather see an official patch for this, but since this helps (but breaks function) I am also willing to share.
We've provide a manual patch here: https://www.joomshaper.com/forum/question/45258
Thanks
@Rvdzande
If you're still using the old version (of Joomla etc), you have to take the risk yourself, which is why the extra work and associated costs are necessary. It's like driving an old car without a warranty.
I think you are wrong there with point 1) because my old SPPB 3.8.10 site also had the font uploads which happened in Joomla 6.x sites. The asset.php file in both 3.x and 6.x looked the same and this was likely manipulated. Since I removed the font upload possibility from my 3.x asset.php I havent seen any odd fonts.
I wrote about Custom Icons upload, that is No1 in Firewall logs. And that feature didn't exist in SPPB 3.8
2nd, SPPB 3.8 don't have also Custom Font Upload feature.
After all I wasn't wrong ;p anyway, thx
I don't get it. My 3.x site was possitively identify for the uploaded fonts hack various times till I changed the script. Also I haven't seen the firewall post, can you share a link (and what are you using?)
My screenshot is from RSFirewall (commercial). As you saw they are trying (blind attack) but they cannot do anything. Those are bots, not humans!
Free component ( https://htprotect.org/en/ ) it should protect your site (J3-J6) as well.
